Hack history / 2021 / Hack or exploit
Merlin
Hack or exploit on May 26, 2021 · Reward Logic Flaw
IN REVIEWSOURCES DISAGREE ON DATE OR LOSS · 3 SOURCES
Lost
$680K
sources: $680K to $6.8M
Returned
none listed
as the sources state it
Rank
#1,053
among thefts by dollars lost
What happened
On May 26, 2021, Merlin Lab (PancakeBunny fork) was exploited for ~$680K via reward calculation flaw. Attacker deposited small amount, sent 180 CAKE to LINK-BNB vault, exploited getReward() function that calculated rewards from contract balance rather than user deposit, and repeated process 36 times. Second $550K attack followed 8 hours later.
In review: possible duplicate within one source; sources disagree on the loss.
Details
- Date
- May 26, 2021
- Kind
- Hack or exploit
- Method
- Reward Logic Flaw
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- BNB Chain
- Audit (rekt.news)
- unaudited
Reported by
Related incidents
Merlin 2024 · Hack or exploit · undisclosed
MERLIN DEX 2023 · Rug pull · $1.8M
Merlin 2021 · Hack or exploit · $330K
Merlin 2021 · Hack or exploit · $550K
Popsicle Finance 2021 · Hack or exploit · $20.7M
MERLIN DEX 2023 · Rug pull · $1.8M
Merlin 2021 · Hack or exploit · $330K
Merlin 2021 · Hack or exploit · $550K
Popsicle Finance 2021 · Hack or exploit · $20.7M
Cite this page
SwanBluechip, "Merlin hack, May 26, 2021: $680K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht9d444fd3b6/ (data as of 2026-10-31).