Merlin’s liquidity pool has been drained of $1.8 million not long after blockchain security firm CertiK audited its code.