Ethereum

A counterfeit network impersonating Upbit-backed GIWA collected nearly $2 million in ETH after users were directed to an unofficial RPC and bridge for a mainnet that has not launched.
A total of <a href="https://x.com/DYORSWAPDEX/status/2104269975745945742" rel="noopener noreferrer nofollow">1,335 addresses bridged about 767.65 ETH</a> into the fake network before approximately 766.25 ETH was transferred out. The fraudulent environment included an OP Stack-like bridge and batcher and began operating after its deployment on September 27.
GIWA Mainnet <a href="https://docs.giwa.io/giwa-chain/en/get-started/connect-to-giwa" rel="noopener noreferrer nofollow">remains under development</a>. The only publicly available GIWA network is GIWA Sepolia, an Ethereum testnet Layer 2 using chain ID 91342, test ETH and the official <code>sepolia-rpc.giwa.io</code> endpoint.
<h2 id="fake-network-used-different-chain-id">Fake Network Used Different Chain ID</h2>
The fraudulent network operated with chain ID 9134, one digit shorter than GIWA Sepolia’s 91342 configuration.
DYORSWAP had added a <a href="https://dyorv3.org/docs" rel="noopener noreferrer nofollow">GIWA environment using chain ID 9134</a> alongside its deployments on other EVM networks. The counterfeit chain therefore appeared inside infrastructure users could interpret as a live GIWA ecosystem deployment even though no production GIWA network existed.
The fake L2 went beyond a cloned website. It processed transactions, operated a bridge and batcher, and posted <a href="https://cryptoadventure.com/focil-explained-how-fork-choice-enforced-inclusion-lists-improve-ethereum-transaction-inclusion/" rel="noopener noreferrer nofollow">transaction batches to Ethereum</a>, giving users an environment that behaved like an operating Layer 2 before the funds were removed.
Three early deposits totaling 0.4 ETH entered only 39 blocks after the bridge became active. Two came from wallets making their first outbound transaction, and those addresses are now among the activity being investigated as possible test wallets connected to the deployment.
<h2 id="giwa-warned-mainnet-was-not-live">GIWA Warned Mainnet Was Not Live</h2>
GIWA responded as claims of an unannounced mainnet and leaked <a href="https://cryptoadventure.com/best-rpc-providers-in-2026-reliability-privacy-tradeoffs-pricing-and-rate-limits/" rel="noopener noreferrer nofollow">RPC</a> spread across social channels.
“We DO NOT have our mainnet running currently,” GIWA <a href="https://x.com/GIWA_by_Upbit/status/2104108336228843590" rel="noopener noreferrer nofollow">warned on September 27</a>, adding that posts claiming to possess GIWA mainnet RPC information were false and urging users to inspect contracts before interacting with them.
An earlier <a href="https://x.com/GIWA_by_Upbit/status/2104091017901433017" rel="noopener noreferrer nofollow">GIWA warning</a> was equally direct: “we haven’t launched our mainnet yet,” making an alleged mainnet RPC leak impossible.
GIWA Sepolia uses test assets with no economic value and is separate from Upbit’s exchange services. GIWA also does not currently plan to issue a separate native token, with ETH designated as the Layer 2’s base asset.
Crypto impersonation campaigns have increasingly copied legitimate infrastructure and branding, including a recent <a href="https://cryptoadventure.com/trezor-and-bitbox-users-targeted-in-coordinated-hardware-wallet-phishing-campaign/" rel="noopener noreferrer nofollow">Trezor and BitBox phishing campaign</a> that used fabricated security warnings to direct wallet users toward malicious pages.
<h2 id="dyorswap-starts-reimbursing-victims">DYORSWAP Starts Reimbursing Victims</h2>
More than <a href="https://x.com/DYORSWAPDEX/status/2104269975745945742" rel="noopener noreferrer nofollow">200 ETH has already been distributed to affected users</a> using DYORSWAP’s own funds while the investigation continues.
The tracing now covers the bridge deployer, its initial funding, early test wallets, batcher infrastructure and the destinations that received the 766.25 ETH removed from the bridge.
The incident did not involve an exploit of GIWA’s active Sepolia testnet. Users instead transferred real ETH into infrastructure impersonating an unreleased network, while GIWA’s legitimate bridge remains a Sepolia testnet bridge using test assets.
The post <a href="https://cryptoadventure.com/fake-giwa-network-drains-766-eth-after-users-bridge-funds-to-counterfeit-l2/" rel="noopener noreferrer nofollow">Fake GIWA Network Drains 766 ETH After Users Bridge Funds to Counterfeit L2</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Fake GIWA Network Drains 766 ETH After Users Bridge Funds to Counterfeit L2

Table of Contents

Crypto Adventure

Other articles published on Sep 28, 2026

Join our free newsletter for daily crypto updates!