Scammers stole approximately 766.25 Ether, worth $2 million, by deploying a sophisticated fake Layer 2 network that impersonated the upcoming Upbit-backed GIWA chain. The counterfeit network used GIWA's actual Chain ID 9134, tricking decentralized exchange DYORSWAP into integrating it. Over 1,300 users bridged funds before the creators drained the contract. DYORSWAP has since distributed over 200 Ether in partial compensation to affected users.
Timeline and movement of stolen funds
- ▪The scammers funneled at least 177 Ether of the stolen funds through the privacy mixer Tornado Cash, while 589 Ether remained in four wallets.
- ▪The deployer wallet for the fraudulent GIWA bridge was funded with 0.045 Ether from an address associated with the instant exchange service ChangeHero on September 26, 2026.
- ▪A fraudulent bridge contract impersonating GIWA Chain 9134 was deployed on September 27, 2026, at 02:10:59 UTC+8, receiving 767.65 Ether from 1,335 user addresses before being drained approximately 12 hours later
Technical operation of the fake network
- ▪A fraudulent network impersonating GIWA operated as a functioning Layer 2 chain using Optimism's OP Stack infrastructure, complete with a bridge, a batcher, and an RPC endpoint
- ▪A fraudulent network impersonating GIWA adopted GIWA's publicly known Chain ID 9134, allowing it to appear legitimate to wallets and decentralized exchange infrastructure
DYORSWAP's integration and user criticism
- ▪DYORSWAP integrated the spoofed GIWA network after the correct Chain ID 9134 made the fake chain appear legitimate during the decentralized exchange's initial verification.
- ▪Users criticized DYORSWAP for enabling the fake GIWA chain scam, arguing that traders only noticed the fake GIWA chain and bridged funds because of the decentralized exchange's integration
DYORSWAP's compensation for affected users
- ▪DYORSWAP offered users who bridged less than 5 Ether to the fraudulent GIWA bridge a 40% refund, while claims exceeding 5 Ether will be reviewed individually
- ▪DYORSWAP distributed more than 200 Ether from its own funds to compensate affected users
Status of the official GIWA network
- ▪GIWA said on September 27, 2026, that its mainnet had not launched and it had no connection to the fake network
- ▪GIWA is an upcoming Layer 2 network developed by Upbit operator Dunamu using Optimism's OP Stack, which launched its Sepolia testnet in September 2025.
Stolen funds and recovery
- ▪A fake bridge impersonating Upbit-backed GIWA stole about 766.25 ETH, worth approximately $2 million
- ▪An address claiming to be from the DYORSWAP team reached out to the scammers behind the fake GIWA bridge theft on-chain to request the return of the stolen funds
Reconstructing the fake chain
- ▪DYORSWAP reconstructed the fake chain by reexecuting transaction batches its batcher posted to Ethereum
- ▪DYORSWAP's reconstruction of the fake chain recorded 1,479 total actions, with 1,148 succeeding across 298 wallets and 104 pools.
Debatable claims
- ▪Crypto traders bear the ultimate responsibility for verifying a network's launch status before bridging funds
- ▪DYORSWAP should fully reimburse users who lost funds to the fake GIWA bridge
- ▪The permissionless design of EVM chain IDs poses an unacceptable security risk to decentralized finance
Story comments
Loading comments…