Merlin DEX (MAGE)
A zkSync DEX (token MAGE) drained of ~$1.8M during its April 2023 token launch — concluded to be a rug pull by rogue developers via excessive 'feeTo' permissions. CertiK had audited it days earlier and later offered a victim compensation plan.
Also known as: Merlin DEX, MAGE
Summary
Merlin DEX was a zkSync-based decentralized exchange with the MAGE token. On April 26, 2023, about $1.8 million (≈435 WETH and ~811,000 USDC) was drained from its liquidity pools during its token "Liquidity Generation Event." Security analysts, including CertiK, concluded it was a rug pull by rogue developers with privileged access. [1][2][3]
Details
The root cause was excessive permissions granted to the contract's "feeTo" role at initialization, which let the deployer withdraw pool reserves directly. CertiK had audited Merlin days earlier (April 14, 2023); after the incident it launched a community compensation plan and urged the "Europe-based" developers to return most of the funds. [2][3]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
Sources (3)
See also
- Bitcoin Latinum (LTNM)TokensA ~$16M token offering (SAFTs for 'Bitcoin Latinum' / LTNM) that the SEC charged in 2026 as fraud: founder Donald Basile falsely called LTNM 'the world's first insured digital asset' backed by an 'existing trust,' neither of which existed, and diverted investor funds for personal use (including a $160,000 horse).
- Loci (LOCIcoin)TokensA 2017–2018 ICO for 'LOCIcoin' tied to the InnVenn IP-search platform. The SEC charged Loci and CEO John Wise with fraud for raising $7.6M on false claims about revenue, headcount, and user base; Wise also misused investor funds. Settled with a $7.6M penalty and an officer/director bar.
- Blockchain Terminal (BCT)Tokens
This page was last updated on Jun 8, 2026. View revision history.