Merlin DEX
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 4 to 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4EuXKh…uBqiSummary
Merlin DEX was a decentralized exchange on zkSync Era that was drained of approximately $1.82 million in April 2023 during the liquidity generation event for its MAGE token. Security researchers and auditor CertiK concluded the incident was an insider rug pull by the protocol's own back-end developers, who held unlimited token approvals over all liquidity pools through a privileged feeTo address; the alleged perpetrators, reportedly based in Serbia, have not been publicly identified or prosecuted. CertiK pledged up to $2 million in compensation but froze only about $160,000 of the stolen funds, and the protocol has been defunct since. It is unrelated to Merlin Chain, a Bitcoin Layer 2 launched in 2024.
Connected Entities
9 entities · 60 linked investigations- Saddle Finance→mentioned with→Ethereum(80%)
- Ethereum→mentioned with→Bitcoin(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- ZachXBT→mentioned with→Binance(60%)
- Binance→mentioned with→Ethereum(65%)
- Arbix Finance→mentioned with→Ethereum(70%)
- Arbix Finance→mentioned with→Binance(70%)
- Merlin DEX→mentioned with→Saddle Finance(80%)
- Merlin DEX→mentioned with→Arbix Finance(80%)
- + 7 more
Connected Through
8 shared actors · 594 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Binanceorganization
Timeline(12 events)
March 2023
zkSync Era mainnet launches; Merlin DEX begins development as an early native DEX on the network.
April 2023
CertiK completes its security audit of Merlin DEX (April 14 according to DL News; April 24 according to an unsourced entry on a merged page), awarding a Skynet score of 90/100. The audit notes centralization risks, reportedly marked as resolved, but does not flag the unlimited feeTo approval as a theft vector.
DL NewsApril 2023
On April 26, Merlin DEX launches the public MAGE token sale and liquidity generation event on zkSync Era. Within hours, rogue back-end developers use the feeTo approvals to drain approximately $1.82 million in USDC and WETH from the liquidity pools.
CoinDeskApril 2023
PeckShield and other security monitors flag the outflow. About $850,000 USDC is bridged from zkSync to Ethereum and moved through PancakeSwap, with $133,800 USDC sent to MEXC Global and $31,000 USDC to Binance.
CryptoSlateApril 2023
CertiK issues an initial statement classifying the incident as a private key management issue (insider rug pull) rather than a smart contract exploit; the Merlin team issues a post-mortem blaming its back-end developer contractors.
The BlockApril 2023
On April 27, CertiK and Merlin DEX announce a joint plan to compensate up to $2 million in user losses, and offer the rogue developers a 20% white-hat bounty to return 80% of the stolen funds.
CoinDeskApril 2023
Merlin's remaining team identifies its back-end contractors as Serbia-based developers and shares their GitHub profiles with Serbian authorities. GitHub accounts pos-ninja, OneDev0411, DotNetStar82 and sallamy2580 are flagged.
tayvano on GitHubMay 2023
On May 4, CertiK announces it has frozen $160,000 of the stolen assets through partner exchanges. Two of four Merlin core team members continue to refuse identity verification, impeding victim compensation.
Crypto.newsMay 2023
CertiK states it has submitted information to US and UK law enforcement agencies.
May 2023
Security research firms including Halborn and BlockApex publish technical post-mortems confirming the feeTo address permissions as the root cause.
HalbornMay 2023
GitHub profile pos-ninja (Haruto Y.) is deleted after May 14, according to post-mortem research. The broader victim compensation plan remains unresolved.
tayvano on GitHubDecision Log
- slot 464365547 · hash 73DKw6anzyp4cALMRWfz3vo3Z8iRijyoSe7Uhtg3goYN
- slot 464365542 · hash FpZUQAz4tLD46nRm1TrpGkmRoVDaSEKDQHEdThFcqoLT
- slot 423154299 · hash 6NrpuxUJ6G3353J22wvy3uN7C8Nmzshcozincnif1PTu
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 23 of 29 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 5/4/2026, 2:54:57 AM
last updated: 11/2/2026, 4:44:56 AM
6 viewsavoid.net — verified advice for a post-truth world