Verify a decision

{"actor":"system:backfill","investigation_id":"4cde30b9-5704-47dc-b0c2-ba2a349ad0cc","kind":"publish","page_slug":"merlin","published_at":"2026-05-30T12:14:35.008Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Merlin DEX","sections":[{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"The Block: zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit","type":"news_article","url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"credibility":1,"name":"CoinDesk: zkSync-Based DEX Merlin Drained of $1.8M During Public Token Sale Despite Audit","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"credibility":2,"name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"Halborn: Explained — The Merlin DEX Hack (April 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023"},{"credibility":2,"name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"credibility":2,"name":"CertiK: Initialization Oversight — The Merlin DEX Exploit","type":"research","url":"https://www.certik.com/skynet-report/initialization-oversight-the-merlin-dex-exploit"},{"credibility":2,"name":"BSC News: CertiK Audit Miss — 2 Lines of Code Result in Over $2M Exploit on zkSync","type":"news_article","url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"credibility":3,"name":"Royals Blue: Rug pull — Merlin siphoned off by its back-end developers","type":"news_article","url":"https://www.royalsblue.com/rug-pull-merlin-siphoned-off-by-its-back-end-developers/"},{"credibility":2,"name":"CertiK: Update on the Merlin DEX Rugpull","type":"official","url":"https://www.certik.com/resources/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull"},{"credibility":2,"name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":2,"name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"credibility":2,"name":"The Cryptonomist: CertiK audit firm guilty of Merlin rug pulling","type":"news_article","url":"https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/"},{"credibility":2,"name":"Merlin DEX CertiK Skynet Project Insight","type":"official","url":"https://skynet.certik.com/projects/merlin-dex"},{"credibility":2,"name":"TokenInsight: Merlin Exploited after CertiK Audit, Raising Questions about Audit Firm Validity","type":"news_article","url":"https://tokeninsight.com/en/news/merlin-exploited-after-certik-audit-raising-questions-about-audit-firm-s-validity"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"credibility":2,"name":"CryptoSlate: CertiK offers Merlin DEX rogue developers 20% white hat bounty","type":"news_article","url":"https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/"},{"credibility":2,"name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"credibility":2,"name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund"},{"credibility":2,"name":"The Coin Republic: Merlin DEX rug pull — $160,000 recovered by security firm","type":"news_article","url":"https://www.thecoinrepublic.com/2023/05/05/merlin-dex-rug-pull-160000-recovered-by-security-firm/"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"credibility":3,"name":"ZachXBT on X (Twitter)","type":"social_media","url":"https://x.com/zachxbt"},{"credibility":2,"name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/"}]},{"content":"","heading":"","severity":"low","sources":[{"credibility":2,"name":"Xverse: What Is Merlin Chain? A Guide to the Native Bitcoin Layer 2","type":"news_article","url":"https://www.xverse.app/blog/merlin-chain"},{"credibility":2,"name":"Merlin Chain official website","type":"official","url":"https://merlinchain.io/"},{"credibility":2,"name":"OKX: What is Merlin Chain? Bitcoin Layer2, Features and Guide","type":"news_article","url":"https://www.okx.com/en-us/learn/what-is-merlin-chain"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: zkSync-Based DEX Merlin Drained of $1.8M During Public Token Sale Despite Audit","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"credibility":1,"name":"CoinDesk: DEX Merlin and CertiK Plan to Compensate $2M to Users Impacted in Rug Pull","type":"news_article","url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"credibility":2,"name":"The Block: zkSync DEX Merlin reportedly hacked for $1.82 million immediately after code audit","type":"news_article","url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"credibility":2,"name":"The Block: Crypto security firm vows refunds for Merlin DEX scam after auditing code","type":"news_article","url":"https://www.theblock.co/post/228485/merlin-scam-certik-refund"},{"credibility":2,"name":"Decrypt: Rogue Developers Drain Merlin DEX of $1.82 Million","type":"news_article","url":"https://decrypt.co/138023/rogue-developers-drain-merlin-dex-of-1-82-million"},{"credibility":2,"name":"DL News: Merlin heist highlights role of code auditor CertiK","type":"news_article","url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"credibility":2,"name":"Halborn: Explained — The Merlin DEX Hack (April 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023"},{"credibility":2,"name":"CryptoSlate: CertiK offers Merlin DEX rogue developers 20% white hat bounty","type":"news_article","url":"https://cryptoslate.com/certik-offers-merlin-dex-rogue-developers-20-white-hat-bounty/"},{"credibility":2,"name":"CryptoSlate: CertiK says it highlighted centralization risks in Merlin DEX audit","type":"news_article","url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"},{"credibility":2,"name":"Crypto.news: CertiK freezes $160k stolen in Merlin DEX insider rug pull","type":"news_article","url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"credibility":2,"name":"CertiK: Update on the Merlin DEX Rugpull","type":"official","url":"https://www.certik.com/resources/blog/6IWcuC1lSDQYQInmJXCloh-certiks-update-on-the-merlin-dex-rugpull"},{"credibility":2,"name":"CertiK Skynet: Merlin DEX Project Insight","type":"official","url":"https://skynet.certik.com/projects/merlin-dex"},{"credibility":2,"name":"CertiK: Initialization Oversight — The Merlin DEX Exploit","type":"research","url":"https://www.certik.com/skynet-report/initialization-oversight-the-merlin-dex-exploit"},{"credibility":2,"name":"BSC News: CertiK Audit Miss — 2 Lines of Code Result in Over $2M Exploit on zkSync","type":"news_article","url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"},{"credibility":2,"name":"The Cryptonomist: CertiK audit firm guilty of Merlin rug pulling","type":"news_article","url":"https://en.cryptonomist.ch/2023/05/09/certik-audit-firm-guilty-merlin-rug-pulling/"},{"credibility":2,"name":"tayvano lazarus-bluenoroff research: merlin_dex.md","type":"research","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"credibility":2,"name":"Unchained Crypto: Exploit or Rug Pull? $1.8 Million Drained From zkSync DEX Merlin Despite Audit","type":"news_article","url":"https://unchainedcrypto.com/exploit-or-rug-pull-1-8-million-drained-from-zksync-dex-merlin-despite-audit/"},{"credibility":2,"name":"The Coin Republic: Merlin DEX rug pull — $160,000 recovered by security firm","type":"news_article","url":"https://www.thecoinrepublic.com/2023/05/05/merlin-dex-rug-pull-160000-recovered-by-security-firm/"},{"credibility":2,"name":"TokenInsight: Merlin Exploited after CertiK Audit, Raising Questions about Audit Firm Validity","type":"news_article","url":"https://tokeninsight.com/en/news/merlin-exploited-after-certik-audit-raising-questions-about-audit-firm-s-validity"},{"credibility":2,"name":"Xverse: What Is Merlin Chain? A Guide to the Native Bitcoin Layer 2","type":"news_article","url":"https://www.xverse.app/blog/merlin-chain"}],"summary":"Merlin DEX was a decentralized exchange built on zkSync Era that was drained of approximately $1.82 million on April 26, 2023, during its public MAGE token liquidity generation event. Security investigators, including auditor CertiK, concluded the incident was an insider rug pull executed by the protocol's own back-end development team, who had embedded a backdoor granting themselves unlimited withdrawal rights over all liquidity pools. The rogue developers, allegedly a group of Serbian nationals, have never been publicly identified or prosecuted, and no meaningful recovery of stolen funds has been confirmed. This entity is distinct from Merlin Chain, an unrelated Bitcoin Layer 2 protocol.","timeline":[{"date":"2023-04-14","event":"CertiK completes security audit of Merlin DEX, awarding a Skynet score of 90/100. The audit notes centralization risks but does not flag the unlimited feeTo approval as an explicit theft vector.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/merlin-heist-highlights-auditor-certik-role-in-defi-security/"},{"date":"2023-04-26","event":"Merlin DEX launches its public MAGE token sale and liquidity generation event on zkSync Era. Within hours, rogue back-end developers exploit the feeTo backdoor to drain approximately $1.82 million in USDC and WETH from all liquidity pools.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/04/26/zksync-based-dex-merlin-drained-of-1m-during-public-token-sale-despite-audit/"},{"date":"2023-04-26","event":"PeckShield and other blockchain security monitors flag the suspicious outflow. Stolen funds begin moving across bridges to Ethereum mainnet, then through PancakeSwap and to exchanges including MEXC and Binance.","source":"CryptoSlate","source_url":"https://cryptoslate.com/certik-says-it-highlighted-centralization-risks-in-merlin-dex-audit/"},{"date":"2023-04-26","event":"CertiK issues initial statement classifying the incident as a private key management issue rather than a smart contract exploit and announces it is investigating. Merlin team issues a post-mortem blaming its back-end developer contractors.","source":"The Block","source_url":"https://www.theblock.co/post/228302/zksync-dex-merlin-hack"},{"date":"2023-04-26","event":"CertiK downgrades Merlin DEX's Skynet score from 90 to 38 following the incident.","source":"BSC News","source_url":"https://www.bsc.news/post/certiks-audit-miss-2-lines-of-code-result-in-over-2m-rug-pull-on-zksync"},{"date":"2023-04-27","event":"CertiK and Merlin DEX announce a joint plan to compensate up to $2 million in user losses. CertiK simultaneously offers the rogue developers a 20% white-hat bounty to return 80% of stolen funds.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/04/27/dex-merlin-and-certik-plan-to-compensate-2m-to-users-impacted-in-rugpull"},{"date":"2023-04-27","event":"Merlin team publicly identifies its back-end contractors as Serbian nationals and shares their GitHub profiles with Serbian law enforcement authorities. GitHub accounts pos-ninja, OneDev0411, DotNetStar82, and sallamy2580 are flagged.","source":"tayvano on GitHub","source_url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"},{"date":"2023-05-04","event":"CertiK announces it has successfully frozen $160,000 of the stolen assets through partner exchange cooperation. Two of four Merlin core team members continue to refuse identity verification, impeding victim compensation.","source":"Crypto.news","source_url":"https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/"},{"date":"2023-05-14","event":"GitHub profile pos-ninja (Haruto Y.) is deleted, according to post-mortem research. Broader victim compensation plan remains unresolved.","source":"tayvano on GitHub","source_url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/merlin_dex.md"}]},"v":1}