Crypto security firm vows refunds for victims of Merlin DEX scam after auditing code.