zkSync-Based DEX Merlin Drained of $1M During Public Token Sale Despite ‘Audit’