In April 2023, malicious DPRK cyberactors targeted the UK-based DeFi project Merlin Dex and stole about $1.8 million in cryptoassets by draining the protocol's liquidity pools. OFSI said the attack was likely caused by a private key compromise or an intentional backdoor that gave the deployer, likely a North Korean IT worker, approval to spend tokens held by the project. The stolen assets were bridged back to Ethereum, swapped for Ether, and moved to other addresses.