Audit log

Every state-changing event for Merlin DEX: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-30 12:14:35Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,154,299

   sig

   4EuXKh3VTCwE…kJVcuBqicopyexplorer ↗

   hash

   6NrpuxUJ6G33…cnif1PTucopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14255 B) ▸

   {"actor":"system:backfill","investigation_id":"4cde30b9-5704-47dc-b0c2-ba2a349ad0cc","kind":"publish","page_slug":"merlin","published_at":"2026-05-30T12:14:35.008Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Merlin DEX","sections":[{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"The Block: zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit","type":"news_article","url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"credibility":1,"name":"CoinDesk: zkSync-Based DEX Merlin Drained of $1.8M During Public Token Sale Despite Audit","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"credibility":2,"name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"Halborn: Explained — The Merlin DEX Hack (April 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023"},{"credibility":2,"name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"credibility":2,"name":"CertiK: Initialization Oversight — The Merlin DEX Exploit","type":"research","url":"https://www.certik.com/skynet-report/initialization-oversight-the-merlin-dex-exploit"},{"credibility":2,"name":"BSC News: CertiK Audit Miss — 2 Lines of Code Result in Over $2M Exploit on zkSync","type":"news_article","url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"credibility":3,"name":"Royals Blue: Rug pull — Merlin siphoned off by its back-end developers","type":"news_article","url":"https://www.royalsblue.com/rug-pull-merlin-siphoned-off-by-its-back-end-developers/"},{"credibility":2,"name":"CertiK: Update on the Merlin DEX Rugpull","type":"official","url":"https://www.certik.com/resources/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull"},{"credibility":2,"name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":2,"name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"credibility":2,"name":"The Cryptonomist: CertiK audit firm guilty of Merlin rug pulling","type":"news_article","url":"https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/"},{"credibility":2,"name":"Merlin DEX CertiK Skynet Project Insight","type":"official","url":"https://skynet.certik.com/projects/merlin-dex"},{"credibility":2,"name":"TokenInsight: Merlin Exploited after CertiK Audit, Raising Questions about Audit Firm Validity","type":"news_article","url":"https://tokeninsight.com/en/news/merlin-exploited-after-certik-audit-raising-questions-about-audit-firm-s-validity"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"credibility":2,"name":"CryptoSlate: CertiK offers Merlin DEX rogue developers 20% white hat bounty","type":"news_article","url":"https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/"},{"credibility":2,"name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"credibility":2,"name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund"},{"credibility":2,"name":"The Coin Republic: Merlin DEX rug pull — $160,000 recovered by security firm","type":"news_article","url":"https://www.thecoinrepublic.com/2023/05/05/merlin-dex-rug-pull-160000-recovered-by-security-firm/"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"credibility":3,"name":"ZachXBT on X (Twitter)","type":"social_media","url":"https://x.com/zachxbt"},{"credibility":2,"name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/"}]},{"content":"","heading":"","severity":"low","sources":[{"credibility":2,"name":"Xverse: What Is Merlin Chain? A Guide to the Native Bitcoin Layer 2","type":"news_article","url":"https://www.xverse.app/blog/merlin-chain"},{"credibility":2,"name":"Merlin Chain official website","type":"official","url":"https://merlinchain.io/"},{"credibility":2,"name":"OKX: What is Merlin Chain? Bitcoin Layer2, Features and Guide","type":"news_article","url":"https://www.okx.com/en-us/learn/what-is-merlin-chain"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: zkSync-Based DEX Merlin Drained of $1.8M During Public Token Sale Despite Audit","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"credibility":1,"name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"credibility":2,"name":"The Block: zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit","type":"news_article","url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"credibility":2,"name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund"},{"credibility":2,"name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million"},{"credibility":2,"name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"credibility":2,"name":"Halborn: Explained — The Merlin DEX Hack (April 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023"},{"credibility":2,"name":"CryptoSlate: CertiK offers Merlin DEX rogue developers 20% white hat bounty","type":"news_article","url":"https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/"},{"credibility":2,"name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"},{"credibility":2,"name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"credibility":2,"name":"CertiK: Update on the Merlin DEX Rugpull","type":"official","url":"https://www.certik.com/resources/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull"},{"credibility":2,"name":"CertiK Skynet: Merlin DEX Project Insight","type":"official","url":"https://skynet.certik.com/projects/merlin-dex"},{"credibility":2,"name":"CertiK: Initialization Oversight — The Merlin DEX Exploit","type":"research","url":"https://www.certik.com/skynet-report/initialization-oversight-the-merlin-dex-exploit"},{"credibility":2,"name":"BSC News: CertiK Audit Miss — 2 Lines of Code Result in Over $2M Exploit on zkSync","type":"news_article","url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"},{"credibility":2,"name":"The Cryptonomist: CertiK audit firm guilty of Merlin rug pulling","type":"news_article","url":"https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/"},{"credibility":2,"name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"credibility":2,"name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/"},{"credibility":2,"name":"The Coin Republic: Merlin DEX rug pull — $160,000 recovered by security firm","type":"news_article","url":"https://www.thecoinrepublic.com/2023/05/05/merlin-dex-rug-pull-160000-recovered-by-security-firm/"},{"credibility":2,"name":"TokenInsight: Merlin Exploited after CertiK Audit, Raising Questions about Audit Firm Validity","type":"news_article","url":"https://tokeninsight.com/en/news/merlin-exploited-after-certik-audit-raising-questions-about-audit-firm-s-validity"},{"credibility":2,"name":"Xverse: What Is Merlin Chain? A Guide to the Native Bitcoin Layer 2","type":"news_article","url":"https://www.xverse.app/blog/merlin-chain"}],"summary":"Merlin DEX was a decentralized exchange built on zkSync Era that was drained of approximately $1.82 million on April 26, 2023, during its public MAGE token liquidity generation event. Security investigators, including auditor CertiK, concluded the incident was an insider rug pull executed by the protocol's own back-end development team, who had embedded a backdoor granting themselves unlimited withdrawal rights over all liquidity pools. The rogue developers, allegedly a group of Serbian nationals, have never been publicly identified or prosecuted, and no meaningful recovery of stolen funds has been confirmed. This entity is distinct from Merlin Chain, an unrelated Bitcoin Layer 2 protocol.","timeline":[{"date":"2023-04-14","event":"CertiK completes security audit of Merlin DEX, awarding a Skynet score of 90/100. The audit notes centralization risks but does not flag the unlimited feeTo approval as an explicit theft vector.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"date":"2023-04-26","event":"Merlin DEX launches its public MAGE token sale and liquidity generation event on zkSync Era. Within hours, rogue back-end developers exploit the feeTo backdoor to drain approximately $1.82 million in USDC and WETH from all liquidity pools.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"date":"2023-04-26","event":"PeckShield and other blockchain security monitors flag the suspicious outflow. Stolen funds begin moving across bridges to Ethereum mainnet, then through PancakeSwap and to exchanges including MEXC and Binance.","source":"CryptoSlate","source_url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"},{"date":"2023-04-26","event":"CertiK issues initial statement classifying the incident as a private key management issue rather than a smart contract exploit and announces it is investigating. Merlin team issues a post-mortem blaming its back-end developer contractors.","source":"The Block","source_url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"date":"2023-04-26","event":"CertiK downgrades Merlin DEX's Skynet score from 90 to 38 following the incident.","source":"BSC News","source_url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"},{"date":"2023-04-27","event":"CertiK and Merlin DEX announce a joint plan to compensate up to $2 million in user losses. CertiK simultaneously offers the rogue developers a 20% white-hat bounty to return 80% of stolen funds.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"date":"2023-04-27","event":"Merlin team publicly identifies its back-end contractors as Serbian nationals and shares their GitHub profiles with Serbian law enforcement authorities. GitHub accounts pos-ninja, OneDev0411, DotNetStar82, and sallamy2580 are flagged.","source":"tayvano on GitHub","source_url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"date":"2023-05-04","event":"CertiK announces it has successfully frozen $160,000 of the stolen assets through partner exchange cooperation. Two of four Merlin core team members continue to refuse identity verification, impeding victim compensation.","source":"Crypto.news","source_url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"date":"2023-05-14","event":"GitHub profile pos-ninja (Haruto Y.) is deleted, according to post-mortem research. Broader victim compensation plan remains unresolved.","source":"tayvano on GitHub","source_url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision abab012c-4d06-421c-87af-bd558fb9083dcopy
2. #2reviewby reviewerreviewer

   2026-11-02 04:44:55Z
   Score: 4 → 4 (no score change)
   The core narrative (about $1.82M drained on April 26, 2023, insider rug pull via the feeTo approval, CertiK 90 to 38 score, $160k frozen May 4, protocol defunct) is corroborated by CoinDesk, Decrypt, DL News and Crypto.news. Problems are editorial. The text contains merge residue ('one page', 'unsourced entry on a merged page') presenting an unsourced April 24 audit date as a competing report. The exchange-level fund-flow figures, the 'first time' restitution claim and the ZachXBT claim could not be verified. The Serbia attribution and named GitHub accounts rest on one secondary compilation relaying Merlin's unverified accusation.
   anchoranchored

   chain

   ●mainnet-betaslot 464,365,542

   sig

   9TuaAXpguZmc…wBA4E2Ghcopyexplorer ↗

   hash

   FpZUQAz4tLD4…ThFcqoLTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1482 B) ▸

   {"actor":"reviewer","artifact_identity":"4e75ce54dbad3474a754d69f19a0a84b","decided_at":"2026-11-02T04:44:55.816Z","decision":"review","disputed_pct":0.3636,"findings_hash":"2hksFUzMNucGKfmoj4HPyYWTyMy9gQo5cxvKWDtD3JMc","investigation_id":"4cde30b9-5704-47dc-b0c2-ba2a349ad0cc","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":4,"omissions":{"material":0,"total":1},"page_content_hash":"f9954e42ece3d5332e592d839d4396fd33a9ac0fa6ede280592b8e4db8c15e69","page_slug":"merlin","prev_score":4,"reason":"The core narrative (about $1.82M drained on April 26, 2023, insider rug pull via the feeTo approval, CertiK 90 to 38 score, $160k frozen May 4, protocol defunct) is corroborated by CoinDesk, Decrypt, DL News and Crypto.news. Problems are editorial. The text contains merge residue ('one page', 'unsourced entry on a merged page') presenting an unsourced April 24 audit date as a competing report. The exchange-level fund-flow figures, the 'first time' restitution claim and the ZachXBT claim could not be verified. The Serbia attribution and named GitHub accounts rest on one secondary compilation relaying Merlin's unverified accusation.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 06da30ff-1788-4fa7-9354-2111a5f057d5copy
3. #3review reviseby judgejudge

   2026-11-02 04:44:56Z
   Score: 4 → 0 (-18)
   The review found 4 of 11 checked claims disputed or unverifiable (about 36%), which falls in the significant-issues band. The core account is corroborated by CoinDesk, Decrypt, DL News and Crypto.news: about $1.82M drained on April 26, 2023, the CertiK score falling from 90 to 38, and $160,000 frozen on May 4 (claim_findings[0], [4], [6]). The problems are mostly editorial or thinly sourced. The page includes leftover merged-page wording about an unsourced April 24 audit date (claim_findings[1]-[3]). The 'first time' restitution claim, the exchange-level fund-flow amounts and the ZachXBT attribution could not be verified (claim_findings[5], [8], [10]). Because the central facts hold up and reviewer confidence is moderate, the penalty is set in the lower part of the band and the page is not delisted.
   anchoranchored

   chain

   ●mainnet-betaslot 464,365,547

   sig

   jVeXnU2taAZU…kxAhisYtcopyexplorer ↗

   hash

   73DKw6anzyp4…htg3goYNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1450 B) ▸

   {"actor":"judge","artifact_identity":"4e75ce54dbad3474a754d69f19a0a84b","band_override":null,"decided_at":"2026-11-02T04:44:55.816Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3636,"investigation_id":"4cde30b9-5704-47dc-b0c2-ba2a349ad0cc","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"merlin","prev_score":4,"reason":"The review found 4 of 11 checked claims disputed or unverifiable (about 36%), which falls in the significant-issues band. The core account is corroborated by CoinDesk, Decrypt, DL News and Crypto.news: about $1.82M drained on April 26, 2023, the CertiK score falling from 90 to 38, and $160,000 frozen on May 4 (claim_findings[0], [4], [6]). The problems are mostly editorial or thinly sourced. The page includes leftover merged-page wording about an unsourced April 24 audit date (claim_findings[1]-[3]). The 'first time' restitution claim, the exchange-level fund-flow amounts and the ZachXBT attribution could not be verified (claim_findings[5], [8], [10]). Because the central facts hold up and reviewer confidence is moderate, the penalty is set in the lower part of the band and the page is not delisted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-18,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ee7c1df6-1635-4364-ae74-a1bda675a693copy