Hackers have exploited the DeFi protocol Merkl to create unverified activities, defrauding users of over $145,000. According to DeFi player YAM, the attackers manipulated the protocol by setting up high APR incentives on Sonic to lure users into depositing USDC into Euler Vaults, which were then drained. The permissionless nature of Euler allowed the deployment of fake markets, with manipulated oracle prices, to attract deposits on Merkl. Despite warnings from Merkl and Euler about unverified activities, YAM urges increased difficulty for such deposits and more warning alerts.