Scammers Drain 766 ETH via Fake GIWA Mainnet
A fraudulent blockchain network masquerading as the upcoming GIWA mainnet successfully siphoned 766 ETH from 1,333 user wallets.
Attackers orchestrated a sophisticated scheme by launching a counterfeit version of the GIWA blockchain, an Ethereum Layer 2 project currently under development by Dunamu. The fake network utilized an RPC endpoint, a cross-chain bridge, and Chain ID 9134—the identifier associated with the project's planned launch—to deceive users into believing the mainnet was live.
The operation began on Sept. 26 when wallets linked to the scheme were funded via ChangeHero. Roughly 11 hours later, the attackers deployed a Safe wallet to control the fraudulent bridge. Over the following 13 hours, 1,333 wallets deposited a total of 767 ETH. Once the funds were collected, the operators modified the bridge's portal code and drained 766 ETH in a single transaction.
GIWA confirmed that no production mainnet RPC exists, noting that its documentation only references the GIWA Sepolia testnet, which uses a different Chain ID of 91342. DYORSWAP, which had community members interact with the fake network, later identified the chain as fraudulent and warned users against using the unofficial infrastructure.
The incident highlights a vulnerability in how EVM networks are identified. While a Chain ID informs a wallet which network it is connected to, it does not verify the legitimacy of the underlying RPC endpoint or bridge. By mirroring the expected Chain ID, the attackers created a facade of legitimacy that allowed them to capture user funds.
According to blockchain analyst Stablemark, 177 ETH has already been moved through Tornado Cash. The remaining 589 ETH is currently held across four wallets, leaving the funds visible on-chain for now. DYORSWAP has initiated a compensation plan for smaller victims, offering to cover 40% of losses for wallets that bridged less than 5 ETH. Claims involving larger amounts are subject to individual verification due to concerns regarding potential links to other fraudulent activity.
DYORSWAP is currently preserving transaction data, bridge addresses, and RPC records to assist in the investigation. The project has also warned victims to exercise caution, noting that scammers may attempt to exploit the situation further by issuing fake reimbursement requests.
