• zkSync project Merlin DEX has suffered a $1.82 million hack, draining its liquidity pool.
  • The attack comes just a few days after the CertiK audit that preceded the platform's launch.
  • The attacker transferred the loot to Ethereum.
  • CertiK has defended itself, saying the audit job was well done, but its audit quality is concerning.

zkSync decentralized exchange (DEX) Merlin was hacked shortly after an audit by smart contract auditor CertiK. Reportedly, the threat actor drained the liquidity pool (LP) and made away with $1.82 million. As the DEX continues to analyze the attack, the team has cautioned everyone linked to its site to revoke their wallets and change the status of their sign permission.

Blockchain security firm PeckShield has revealed that the attacker is already sending the loot to exchanges, citing $133,800 USDC sent to MEXC Global and $31,000 USDC to Binance.

PeckShield has also provided the hacker's addresses, indicating that two addresses were responsible for the exploit. Reportedly, the first address, which starts with 0x2744, took $850,000 USDC before bridging it to Ethereum. The other address, starting with 0x2744d62, looted $844,000 USDC.

The fact that the attacker drained the liquidity pools indicates that they somehow engineered the LP's smart contracts.

Considering CertiK also audited Terra, the attack has raised concerns over the validity of the firm's audits, despite it being one of the biggest brands in the blockchain security space. Other CertiK clients that suffered hacks post-audit include PancakeBunny, Uranium Finance, and Meerkat Finance. This has cast doubt on the quality of CertiK audits.  

Two views have already questioned the Certik audit, suggesting that Merlin could be a rug.  Another said:

In the Merlin code, there is a "backdoor" code (L87-88) that allows the feeTo of MerlinFactory to transfer all assets in the pair, in addition to the fee in the swap function.

CertiK defends itself and says the audit job was well done

According to CertiK, an initial probe into the attack shows that the root cause was a potential private key management issue, not an exploit.

Notably, the blockchain security firm says it had highlighted the "centralization risk" in its audit under the "Decentralization Efforts" section, adding, "Audits cannot prevent private key issues. The auditor has also committed to sharing relevant information with the authorities if there is suspicion of foul play.

In an April 26 interview with Chinese media, Certik founder and professor at Columbia University, Gu Ronghui, proudly said:

We (CertiK) have turned blockchain security into a track almost by ourselves, which has attracted a lot of attention.

Gu also boasted about CertiK's 70% share of the crypto security market, saying that the auditing firm had reduced the cost of Web3 security audits by more than 90%. 

Notwithstanding, the crypto community will be doubly cautious about the Merlin platform, whose main token is MAGE, currently in the public sale phase. Among the main offerings of the DEX is Core Farming Pools, which according to officials, would only be launched after the audit is completed to reassure investors.

Notably, the hack happened on the same day this interview was published. CertiK will remain under the microscope. 


Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.

If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.

FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.

The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.

Recommended content


Recommended Content

Editors’ Picks

Ripple's XRP set sights on $1.100 following renewed investor interest

Ripple's XRP set sights on $1.100 following renewed investor interest

Ripple's XRP rallied nearly 20% on Tuesday, defying the correction seen in Bitcoin and Ethereum as investors seem to be flocking toward the remittance-based token. 

More Ripple News
Dogecoin Price Prediction: Could DOGE ETF spark new all-time high after 130% rise?

Dogecoin Price Prediction: Could DOGE ETF spark new all-time high after 130% rise?

Dogecoin rose over 15% on Tuesday as traders anticipate a price move toward the $1 threshold following Bloomberg analyst Eric Balchunas's post regarding a DOGE exchange-traded fund.

More Dogecoin News
Hedera's HBAR rallies nearly 20% as Canary Capital files for HBAR ETF

Hedera's HBAR rallies nearly 20% as Canary Capital files for HBAR ETF

Hedera's HBAR is up nearly 20% on Tuesday as Canary Capital submitted an S-1 registration to the US Securities & Exchange Commission for an HBAR exchange-traded fund.

More Hedera News
Ethereum Price Forecast: ETH down despite hype from Beam Chain unveil

Ethereum Price Forecast: ETH down despite hype from Beam Chain unveil

Ethereum is down 1% on Tuesday despite developer Justin Drake proposing the Beam Chain, a new consensus layer that aims to ship a series of changes that will fast-track the Main chain's roadmap to faster block times and quantum resistance.

More Ethereum News
Bitcoin: Further upside likely after hitting new all-time high

Bitcoin: Further upside likely after hitting new all-time high

Bitcoin hit a fresh high of $76,849 on Thursday as crypto-friendly candidate Donald Trump won the US presidential election. Institutional demand returned with the highest single-day inflow on Thursday since the ETFs’ launch in January.

Read full analysis
Best Forex Brokers with Low Spreads

Best Forex Brokers with Low Spreads

VERIFIED Low spreads are crucial for reducing trading costs. Explore top Forex brokers offering competitive spreads and high leverage. Compare options for EUR/USD, GBP/USD, USD/JPY, and Gold.

Read More

BTC

ETH

XRP