Scammers built a counterfeit version of Upbit-backed GIWA blockchain and lured 1,333 wallets into depositing 767 ETH, worth about $2 million, before draining almost all of it.
The fake network appeared to be GIWA’s anticipated Ethereum Layer 2 mainnet, complete with an RPC endpoint, cross-chain bridge, and Chain ID 9134, the identifier associated with the planned launch.
But GIWA’s mainnet was not live.
In an X post, GIWA said claims that its production RPC had leaked were false because no mainnet RPC exists. Its documentation lists only GIWA Sepolia, which uses Chain ID 91342, while the production network remains under development.
DYORSWAP, whose community initially interacted with the purported network, later said the chain was fraudulent and warned users against unofficial RPC endpoints, bridges and contracts. It stated:
“The fake network used the correct GIWA Chain ID (9134), which made it appear legitimate during our initial verification. We have also identified specific suspicious messages and individuals in the related community that may be connected to this incident.”
Dunamu, operator of South Korea’s largest crypto exchange, Upbit, is developing GIWA using Optimism’s OP Stack.
Dunamu and the Optimism Foundation announced in May that GIWA is planned as the first Self-Managed OP Enterprise chain, allowing Upbit to retain operational control while Optimism provides backup infrastructure and support.
Attackers waited for deposits before changing the bridge
On-chain data suggests the attackers spent hours preparing the infrastructure before the first significant deposits arrived.
Pseudonymous blockchain analyst Stablemark said wallets tied to the operation were funded through ChangeHero on Sept. 26. About 11 hours later, the Safe wallet controlling the scheme and the fake bridge went live.
Over the next 13 hours, 1,333 wallets deposited a combined 767 ETH.
The operators then changed the bridge’s portal code and drained 766 ETH in a single transaction, according to Stablemark.
The sequence suggests the bridge remained operational long enough to accumulate deposits before the operators replaced its controlling code and removed the funds.
The attack relied in part on how EVM networks are identified. A Chain ID can tell a wallet which network it is connected to, but it does not verify who controls the RPC endpoint or bridge behind that network.
By using GIWA’s expected Chain ID 9134, the operators could make the environment appear consistent with the anticipated mainnet while retaining control of the infrastructure receiving user funds.
The stolen ETH has since begun to move.
Stablemark said 177 ETH was routed through Tornado Cash, complicating efforts to trace its subsequent destination, while another 589 ETH remained spread across four wallets at the time of his update.
That leaves most of the stolen funds visible on-chain for now, though further transfers to mixers, exchanges, or other services could narrow the window for investigators to freeze or recover them.
DYORSWAP offers 40% compensation to smaller victims
DYORSWAP has moved to compensate some users caught in the fake blockchain scheme after reviewing affected addresses.
The project said wallets that bridged less than 5 ETH would receive compensation equal to 40% of their cross-chain amount.
Claims involving more than 5 ETH will be handled separately and require identity and address verification, because DYORSWAP said some larger wallets could be linked to phishing or other fraudulent activity.
It also published an address for compensation distributions and warned victims to verify it through official channels, citing the risk that scammers could exploit the incident again using fake reimbursement requests.
The compensation plan leaves substantial losses with users even where claims are approved. Smaller victims would recover less than half of what they deposited under the announced terms, while outcomes for larger wallets remain subject to individual review.
DYORSWAP has said it is preserving RPC records, bridge addresses, transaction data and community communications as investigators reconstruct how the fraudulent network spread.