• zkSync project Merlin DEX has suffered a $1.82 million hack, draining its liquidity pool.
  • The attack comes just a few days after the CertiK audit that preceded the platform's launch.
  • The attacker transferred the loot to Ethereum.
  • CertiK has defended itself, saying the audit job was well done, but its audit quality is concerning.

zkSync decentralized exchange (DEX) Merlin was hacked shortly after an audit by smart contract auditor CertiK. Reportedly, the threat actor drained the liquidity pool (LP) and made away with $1.82 million. As the DEX continues to analyze the attack, the team has cautioned everyone linked to its site to revoke their wallets and change the status of their sign permission.

Blockchain security firm PeckShield has revealed that the attacker is already sending the loot to exchanges, citing $133,800 USDC sent to MEXC Global and $31,000 USDC to Binance.

PeckShield has also provided the hacker's addresses, indicating that two addresses were responsible for the exploit. Reportedly, the first address, which starts with 0x2744, took $850,000 USDC before bridging it to Ethereum. The other address, starting with 0x2744d62, looted $844,000 USDC.

The fact that the attacker drained the liquidity pools indicates that they somehow engineered the LP's smart contracts.

Considering CertiK also audited Terra, the attack has raised concerns over the validity of the firm's audits, despite it being one of the biggest brands in the blockchain security space. Other CertiK clients that suffered hacks post-audit include PancakeBunny, Uranium Finance, and Meerkat Finance. This has cast doubt on the quality of CertiK audits.  

Two views have already questioned the Certik audit, suggesting that Merlin could be a rug.  Another said:

In the Merlin code, there is a "backdoor" code (L87-88) that allows the feeTo of MerlinFactory to transfer all assets in the pair, in addition to the fee in the swap function.

CertiK defends itself and says the audit job was well done

According to CertiK, an initial probe into the attack shows that the root cause was a potential private key management issue, not an exploit.

Notably, the blockchain security firm says it had highlighted the "centralization risk" in its audit under the "Decentralization Efforts" section, adding, "Audits cannot prevent private key issues. The auditor has also committed to sharing relevant information with the authorities if there is suspicion of foul play.

In an April 26 interview with Chinese media, Certik founder and professor at Columbia University, Gu Ronghui, proudly said:

We (CertiK) have turned blockchain security into a track almost by ourselves, which has attracted a lot of attention.

Gu also boasted about CertiK's 70% share of the crypto security market, saying that the auditing firm had reduced the cost of Web3 security audits by more than 90%. 

Notwithstanding, the crypto community will be doubly cautious about the Merlin platform, whose main token is MAGE, currently in the public sale phase. Among the main offerings of the DEX is Core Farming Pools, which according to officials, would only be launched after the audit is completed to reassure investors.

Notably, the hack happened on the same day this interview was published. CertiK will remain under the microscope. 

Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.

If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.

FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.

The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.

Join Telegram

Recommended content

Recommended Content

Editors’ Picks

Fetch.ai Price Prediction: FET must hold above $1.70 for strength

Fetch.ai Price Prediction: FET must hold above $1.70 for strength

Fetch.ai price has dropped nearly 45% since late March as broader markets started bleeding. FET bulls must defend $1.70 if they want to keep the upward thrust alive, signaling strength on the AI coin. A break and close below $1.59 would mean a lower low, invalidating the bullish reversal thesis.

More Fetch.ai News

OKX executives depart from exchange while its XLayer Chain goes live

OKX executives depart from exchange while its XLayer Chain goes live

Two senior executives at crypto exchange OKX, Tim Byun and Wei Lan, have left the company after years of heading key roles, according to a CoinDesk source. However, the company is making expansion moves through the launch of its own Layer 2 (L2) chain.

More Cryptocurrencies News

Traders eyeing long positions could have their rally soon as funding rates flip negative

Traders eyeing long positions could have their rally soon as funding rates flip negative

Bitcoin (BTC) price remains on a load-shedding exercise, a sentiment that has spilled over to the broader market. Nevertheless, the bleed seen across the cryptocurrency market could end soon amid possible shifting market sentiment.

More Cryptocurrencies News

Prisma Finance hacker could be uncovered after investigations by on-chain analyst

Prisma Finance hacker could be uncovered after investigations by on-chain analyst

On March 28, DeFi protocol Prisma Finance suffered an attack on one of its smart contracts, resulting in a loss of 3257 ETH worth $11.1 million. Prisma Finance immediately halted its protocol after the hack, ordering users to revoke access to the smart contract.

More Cryptocurrencies News

Bitcoin: BTC’s rangebound movement leaves traders confused

Bitcoin: BTC’s rangebound movement leaves traders confused

Bitcoin (BTC) price has been hovering around the $70,000 psychological level for a few weeks, resulting in a rangebound movement. This development could lead to a massive liquidation on either side before a directional move is established. 

Read full analysis