On April 25, 2023, zkSync DEX Merlin was exploited for $1.82 million. The attacker drained pools through the feeTo address in MerlinFactory which had unlimited asset transfer permissions and lacked multi-sig governance.