zksync DEX Merlin Reportedly Hacked for 1.82 Million Immediately After Code Audit

Updated: 26 April 2023

Disclosure

Don’t invest unless prepared to lose all the money you invest. This is a high-risk investment, you shouldn’t expect to be protected if something goes wrong.

Join Our Telegram channel to stay up to date on breaking news coverage

zkSync-base decentralized exchange (DEX) Merlin has been hacked, resulting in the loss of over $1.82 million worth of stolen funds.

The security breach occurred during a public sale of its mage (MAGE) tokens, which allowed exploiters to drain some $850,000 worth of USD Coin (USDC). The hackers were also able to steal more funds from the liquidity pool on the platform. According to blockchain data, a party in control of the liquidity pool was effortlessly able to withdraw the funds. This suggests that this was not a sophisticated or complicated hack.

The team at Merlin has confirmed the incident in a Medium post. The team noted that the security exploit had occurred despite their “best efforts to ensure the safety and security of users’ funds.” Merlin has assured users that they are investigating the incident. Merlin also stated that it is working with security experts to determine the cause of the breach. Additionally, Merkin will only launch the Core Farming Pools and public sale after a thorough audit by Certik to reassure investors.

Hack Occurred Shortly after Code Audit by Certik

Merlin had recently undergone an audit by blockchain security firm Certik. According to data on CertiK’s website, the audit concluded that the platform had “no critical findings.” The hack happened shortly after the audit had concluded. Certik stated in a tweet that it is investigating the event. According to Certik, its preliminary findings point to a potential problem with private key management rather than a potential code hack.

“While audits cannot prevent private key issues, we always highlight best practices to projects. Should any foul play be discovered, we will work with the appropriate authorities and share relevant info,” Certik said.

We’re actively investigating the @TheMerlinDEX incident. Initial findings point to a potential private key management issue rather than an exploit as the root-cause.

While audits cannot prevent private key issues, we always highlight best practices to projects.

Should any foul…

— CertiK (@CertiK) April 26, 2023

According to reports from Wu Blockchain, officials from Merlin said that the exchange delayed the launch of the Core Farming Pools and public sale until Certik concluded the Audit. However, the hack occurred shortly after the public sale began. Unidentified people took over and stole the funds.

zkSync DEX Merlin which got Certik Audit was hacked, more than $1.82 million in stolen funds, LP has been drained. Recently, the zkSync project has mixed quality. please check carefully. https://t.co/wEYOPXMwMZ

— Wu Blockchain (@WuBlockchain) April 26, 2023

The attack raises questions about the security and reliability of the zkSync project and has sparked concerns about the safety of other platforms built on this technology. Further, the incident highlights the need for rigorous security measures and regular audits to ensure the safety of investors’ funds.

The security breach at zkSync DEX Merlin serves as a stark reminder of the importance of security in the crypto space. It remains to be seen how this incident will impact the broader cryptocurrency market. However, it is crucial that investors exercise caution and conduct due diligence when investing in crypto projects to avoid falling victim to similar attacks.