Scammers constructed a fraudulent blockchain mimicking GIWA, an Ethereum Layer 2 network in development by Upbit, South Korea's largest cryptocurrency exchange. The fake network attracted 1,333 wallets that deposited a combined 767 ETH, valued at approximately $2 million, before attackers drained 766 ETH in a single transaction.
The counterfeit network included infrastructure typical of legitimate blockchains, such as an RPC endpoint and cross-chain bridge. Critically, it used Chain ID 9134, the identifier associated with GIWA's anticipated mainnet launch, lending the fraudulent chain an appearance of legitimacy.
GIWA, developed using Optimism's OP Stack technology, is not currently live. The project confirmed in a statement that no production RPC endpoint exists and that its documentation lists only GIWA Sepolia, which uses a different Chain ID. The actual network remains under development.
How the Attack Unfolded
According to blockchain analyst Stablemark, the attackers methodically prepared infrastructure before soliciting deposits. Wallets tied to the operation received funding through ChangeHero on September 26. Approximately 11 hours later, the bridge went live. Over the next 13 hours, deposits accumulated to 767 ETH before operators altered the bridge's code and withdrew the funds.
The scheme exploited a fundamental aspect of blockchain identification: while a Chain ID signals to a wallet which network it is connected to, it does not verify who controls the RPC endpoint or bridge infrastructure. By using GIWA's expected Chain ID, the attackers created an environment that appeared consistent with the anticipated mainnet while maintaining control over user funds.
Fund Movement and Recovery Efforts
The stolen ETH has begun moving across the blockchain. Stablemark reported that 177 ETH was routed through Tornado Cash, a mixing service that complicates fund tracing. An additional 589 ETH remained spread across four wallets at the time of the update, leaving most stolen funds visible on-chain for now.
DYORSWAP, a project whose community initially interacted with the fake network, identified the scheme as fraudulent and warned users against unofficial RPC endpoints and bridges. The project is offering compensation to affected users: wallets that bridged less than 5 ETH will receive 40% of their deposited amount, while larger claims require identity verification and individual review.
DYORSWAP has preserved RPC records, bridge addresses, transaction data, and community communications to assist investigators. The project also published an official compensation address while warning victims to verify it through official channels to prevent additional fraud.
