What happened
The attacker's address:
https://bscscan.com/address/0x2bADa393…1645BD
"Via the smart contract, a hacker deposited 0.1WBNB into the vault and then manually transferred 1000BNB into the contract to trick the contract into thinking it has received 1000BNB in rewards, which resulted in the minter producing MERL rewards."
Stolen funds were bridged into Ethereum mainnet at:
https://etherscan.io/tx/0x7926165e…11346a
Deposited into Tornado Cash mixer at:
https://bloxy.info/ru/txs/transfers_from/0x2bada393…1645bd?currency_id=1
Case & protocol details
Classification
Protocol Logic / Yield Aggregator / Token & Share Accounting
Protocol Type
Yield
Affected asset / contract
MERL
Smart Contract Language
Solidity
Official Website
merlinlab.com/farm
Protocol Twitter/X
@MerlinLab_
Evidence & learning
Sources and on-chain records
- report Post-mortem rekt.news
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.