Fraudsters have created a counterfeit version of the L2 network GIWA, utilizing the authentic Chain ID 9134, and have deceived users into transferring nearly 767 ETH. The decentralized exchange DYORSWAP has already compensated affected users with over 200 ETH from its own reserves.
— DYORSWAP (@DYORSWAPDEX) September 27, 2026
DYORSWAP clarified that this incident was not the result of a contract hack, but rather a malicious attack through a fraudulent L2 infrastructure that the exchange mistakenly accepted as a legitimate project due to the valid Chain ID.
The scammers launched a fake network based on OP Stack and deployed a bogus bridge. Shortly after its initiation, deposits in ETH began flooding in. According to recovered data, funds were funneled through 1,335 addresses, resulting in total incoming transactions of approximately 767.65 ETH.
The first three deposits raised suspicions, as they were made in a single block and second, each totaling exactly 0.4 ETH. DYORSWAP suspects these may have been pre-prepared test wallets controlled by the scammers.
A critical moment occurred when around 766.25 ETH (valued at about $2 million at that time) was withdrawn from the bridge.
In a statement from the L2 network project, which is operated by the centralized exchange Upbit through the company Donamu, it was emphasized that the mainnet is not yet operational.
I don’t know how I could emphasize this further :
— GIWA (@GIWA_by_Upbit) September 27, 2026
We DO NOT have our mainnet running currently. Any of those posts claiming that they have GIWA mainnet RPC information are NOT TRUE.
Please, please check the contracts that you interact with and PLEASE STAY SAFE
"We have confirmed that the so-called GIWA Mainnet we previously identified was, in fact, a fake blockchain created by scammers," the developers stated.
The project has indicated that it is currently gathering evidence, including chat logs, RPC data related to the bridge's address, and on-chain transactions.
GIWA also mentioned that they are preparing compensation for the affected users from their treasury. In a separate update, the project noted:
DYORSWAP has reported that it has already distributed over 200 ETH to traders impacted by the incident.
The investigation is ongoing, with teams working to trace the bridge's deployer, the source of its funding, the packet processing infrastructure, and the subsequent movement of funds.
For context, the U.S. Department of the Treasury's Financial Crimes Enforcement Network identified operations related to cryptocurrency scams amounting to $12.7 billion from September 2023 to January 2026.
Stay updated by following ForkLog on social media.
Telegram (main channel) Facebook X