Scammers Drain $2M in ETH Using Fake GIWA Layer 2 Network

Attackers launched a counterfeit blockchain posing as the GIWA mainnet, a project currently under development by Upbit parent company Dunamu. The fake network, which had not yet officially launched, managed to siphon approximately 766.25 ETH from 1,335 addresses, with total losses estimated near $2 million.

The scammers utilized chain ID 9134, the legitimate identifier reserved for the actual GIWA network, to give the fraudulent chain an appearance of authenticity. The fake infrastructure included a functional cross-chain bridge, a batcher, and OP Stack compatibility.

The scheme gained traction after the decentralized exchange DYORSWAP listed the fraudulent network as the genuine GIWA mainnet. This listing led to an acceleration in deposits, with roughly 767.65 ETH flowing across the bridge before the attackers drained the funds.

On September 27, the GIWA project confirmed that its mainnet had not yet launched and that all associated RPCs and infrastructure claims were fabricated. The project also clarified that it does not have a separate native token, as the network is designed to use ETH for gas fees.

DYORSWAP acknowledged its role in the incident, noting that the reuse of the reserved chain ID allowed the fake network to bypass initial checks. The platform is currently using its own treasury to compensate victims, having already credited over 200 ETH to users with larger losses, while smaller losses are being handled at a 40% compensation rate.

Community members also identified suspicious trading activity involving a meme token called $FAKER prior to the exposure of the fraud. Both GIWA and DYORSWAP have advised users to avoid unofficial endpoints and contracts while investigations into the stolen funds continue.