Crypto · updated 1h ago · 2 min read
Scammers Impersonate GIWA, Drain 766.25 ETH After DYORSWAP Registers Fake Chain
Scammers built a fake GIWA mainnet to deceive DYORSWAP. 767 ETH drained, about $2 million in total.
7 of 9 outlets skipped it: attackers used chain ID 9134 tied to GIWA.
13outlets compared
Same story, two versions
tap a side to read it in full
UseTheBitcoin
“The fraudulent network operated as a functioning Layer 2 and used chain ID 9134”Read the original ↗
Cointelegraph
“Scammers stole about $2 million in Ether (ETH) from a bridge for a fake GIWA blockchain”Read the original ↗
Some outlets stress scam sophistication as a working L2, others keep it bridge-centric.
Fake GIWA drains ETH
Scammers impersonated GIWA and drained approximately ₩2.8 billion (approximately $2.1 million) worth of Ethereum from users after overseas decentralized exchange DYORSWAP mistakenly registered a fake chain as the legitimate GIWA Chain. DYORSWAP recognized a fake GIWA network with chain ID "9134" as the official GIWA Chain on the 27th (local time), while the official "GIWA Sepolia" testnet operated by Dunamu used chain ID "91342". 1,335 user wallet addresses transferred a total of 767.65 ETH to the fake network, and approximately 766.25 ETH was drained externally.
DYORSWAP corrected the chain registration within four minutes of recognizing the situation, but the scam operators had already siphoned off the funds. GIWA responded through X (formerly Twitter) by stating, "The GIWA Chain mainnet is not currently operational," and it urged users to "Please thoroughly verify contracts before transacting."
Compensation and tracing
DYORSWAP said it initiated a compensation process and had already distributed over 200 ETH from its own funds to affected users while the investigation continued. DYORSWAP’s compensation drew criticism because its initial proposal offered only 40% reimbursement for transfers under 5 ETH and required direct contact for review of amounts exceeding 5 ETH. GIWA denied that any production RPC information had leaked and warned that purported mainnet connection details circulating online were false.
DYORSWAP said it was tracing the bridge deployer, funding sources, suspected test wallets, and the final destination of the 766.25 ETH drained from the bridge. GIWA also warned that the mainnet had not yet been launched, and it told users to verify contracts before transacting.
A functioning fake chain
The scam went beyond simple website cloning because it processed transactions and posted transaction batches to the Ethereum mainnet, operating like a functioning Layer 2. BigGo Finance said the fake network was equipped with OP Stack-style bridge and batcher infrastructure and received its first three deposits totaling 0.4 ETH just 39 blocks after bridge activation. Cointelegraph said DYORSWAP said its contracts had not been compromised and that it was tracing the bridge deployer, funding sources, suspected test wallets and the addresses that received the funds.C
GIWA said its mainnet was not live and that purported mainnet connection details circulating online were false, while it said its Sepolia testnet was available as a public test environment. The incident left users facing a gap between what was deposited and what was drained, with 767.65 ETH transferred to the fake network and 766.25 ETH drained externally.