Merlin Labs Hit Again Hours After Its First Exploit, Losing 200 More ETH

One exploit in a single day wasn't the end of it for Merlin Labs.

Following our earlier coverage of the project's $680,000 loss, a reader pointed out that the story hadn't finished there.

Roughly eight hours after the first incident, Merlin Labs was drained of approximately 200 additional ETH through an entirely separate vulnerability. Transaction details are available here. The second attacker's address can be viewed on BscScan.

This time, the flaw lived in a newly deployed priceCalculator, which mispriced only the BAND token — credit to watchpug for the breakdown.

The upshot: roughly $550,000 lost as a direct result of a patch that introduced more risk than it removed.

Merlin's team subsequently published a compensation plan intended to cover victims of both the original exploit and this follow-up incident.

When we said Merlin Labs "must try harder," climbing the rekt leaderboard wasn't quite the interpretation we had in mind. This second loss gave the project another shot at moving up — instead, it stayed put at position #28.

Must try harder, indeed.