Sophisticated Heist: How Scammers Mimicked the GIWA Blockchain to Steal $2 Million

A highly coordinated phishing operation recently exploited the anticipation surrounding the GIWA blockchain launch, a Layer 2 network backed by South Korea’s Upbit. By deploying a counterfeit network that mirrored official specifications, attackers successfully deceived over 1,300 users into depositing 767 ETH—worth approximately $2 million—before draining the funds through a manipulated cross-chain bridge.

The Illusion of Legitimacy

The success of the scam rested on the attackers' ability to exploit technical identifiers to create a sense of false security. The fraudulent network utilized Chain ID 9134, the exact identifier reserved for GIWA’s upcoming Ethereum Layer 2 mainnet. By setting up a fake RPC endpoint and bridge that appeared to match official documentation, the scammers created a convincing environment for users and community platforms like DYORSWAP. In reality, GIWA’s developer, Dunamu, clarified that the production network is still under development and no official mainnet RPC exists yet, as only the "GIWA Sepolia" testnet is currently active.

Execution and the Path to Recovery

On-chain analysis reveals a calculated timeline where the attackers spent hours preparing the infrastructure before the first significant deposits arrived. Once the bridge had accumulated enough liquidity over a 13-hour window, the operators modified the bridge’s portal code to drain nearly all the assets in a single transaction. Since the theft, a portion of the stolen ETH has been moved through the privacy mixer Tornado Cash to obscure its trail, while the remainder remains visible in several wallets. In response to the incident, DYORSWAP has announced a limited compensation plan, offering to return 40% of losses to smaller victims while conducting deeper investigations into larger claims to filter out potential accomplice wallets.