Merlin’s exploit was carried out by its bank-end developer team after they manipulated the protocol’s contracts and web host.
