Scammers deploy fake Giwa layer-2 chain and drain 766 ETH from 1,335 DYORSWAP users
Scammers built a counterfeit Giwa layer-2 network with the correct chain ID 9134, drew 767 ETH from 1,335 DYORSWAP users, then drained 766 ETH and sent 177 ETH through Tornado Cash.
Why it matters
A valid-looking chain ID, RPC endpoint and cross-chain bridge were enough to pass an initial verification at a multi-chain DEX, and the funds are already moving through a mixing service, which limits recovery. The loss is a single $2 million theft rather than a protocol failure, and its broader market significance is limited.
Where the sources disagree
Nature of the counterfeit chain
OP stack-style infrastructure, a bridge and a batcher that functioned
Bitcoin.com News, CryptoSlate, Protos
Details of the exact mechanism remain limited; framed as an impersonation scam relying on social engineering
Bitcoin Insider
DYORSWAP and CryptoSlate describe a working OP Stack chain with an RPC endpoint, a bridge and a batcher, while Bitcoin Insider reports the exact mechanism as unconfirmed and frames the incident as a conventional impersonation scam.
Whether the counterfeit's plumbing was supplied through a GIWA RPC leak
Giwa: claims that its production RPC had leaked were false because no mainnet RPC exists
CryptoSlate, Cointelegraph
DYORSWAP: specific suspicious messages and individuals in the community may be connected to the incident
CryptoSlate, Protos
Giwa denies any leak of a production RPC because no mainnet RPC exists, while DYORSWAP said specific suspicious messages and individuals in its community may have planted the false information.
Key facts
Scammers deployed a counterfeit Giwa layer-2 chain using chain ID 9134, the identifier associated with the planned production launch.
9,134Reported by Bitcoin.com News
DYORSWAP said its contracts were not compromised and the fraud happened in a bridge it had accepted as the genuine Giwa mainnet.
Reported by Cointelegraph
The fraudulent bridge received about 767.65 ETH from 1,335 addresses.
767.65 ETHDisputed figureReported by Cointelegraph
CryptoSlate reported that 1,333 wallets deposited 767 ETH, worth about $2 million, into the fake chain.
767 ETHDisputed figureReported by CryptoSlate
The scammers drained 766.25 ETH from the fake bridge, valued at about $2 million.
766.25 ETHReported by Cointelegraph
Giwa said no mainnet RPC exists, its documentation lists only the Giwa Sepolia testnet on chain ID 91342, and the production network is still under development.
91,342Reported by CryptoSlate
Stablemark, as cited by CryptoSlate, found 177 ETH entered Tornado Cash and 589 ETH remains across four wallets.
177 ETHReported by CryptoSlate
What happened
A group of scammers deployed a counterfeit version of the Giwa layer-2 network, an Upbit-backed project developed by Dunamu, and the decentralized exchange DYORSWAP initially accepted it as the real mainnet. DYORSWAP said the fraudulent bridge received about 767.65 ETH from 1,335 addresses, and the scammers then drained 766.25 ETH, roughly $2 million. Bitcoin.com News reported 1,335 users and 766 ETH, while CryptoSlate counted 1,333 wallets and 767 ETH in, with 589 ETH still sitting across four wallets and 177 ETH sent into Tornado Cash, according to Stablemark, a blockchain analytics firm CryptoSlate cited. Giwa denied any leak, saying in an X post that claims its production RPC had been compromised were false because no mainnet RPC exists, and its documentation lists only the Giwa Sepolia testnet on chain ID 91342. Bitcoin Insider, an aggregator, said the technical mechanism was not confirmed and characterised the incident as an impersonation scam, which conflicts with DYORSWAP's account of a working OP Stack chain with a bridge, a batcher and an RPC endpoint. Still unclear is how the counterfeit chain reached DYORSWAP's community, and how much of the 589 ETH remaining in four wallets can be recovered.
How the story developed
- First report
First report by Bitcoin.com News
Scammers Launch Fake ETH L2 to Steal $2M From Crypto Traders
- Update
Bitcoin.com News reports the fake Giwa chain and the loss of more than 760 ETH
The first report, published at 08:01 CEST, named DYORSWAP as the party that identified the counterfeit chain and said a compensation process had been announced.
- Independent corroboration
Independently corroborated by CryptoSlate
Crypto scammers built an entire fake blockchain to steal over $2 million
- Update
Stablemark trace shows 177 ETH through Tornado Cash with 589 ETH in four wallets
CryptoSlate cited Stablemark, which said the remaining 589 ETH could still be moved or frozen.
- Official statement
Giwa states its mainnet is not running
The project wrote that it does not have its mainnet running currently and that connection details circulating online were false.
- Official statement
DYORSWAP publishes a reconstruction and admits the chain was fake
It said the so-called Giwa Mainnet it had identified was a fake chain set up by scammers, traced the bridge deployer and funding sources, and said it had paid more than 200 ETH from its own funds.
- Update
Fake bridge contract deployed shortly after 18:00 UTC on Saturday
The spoofed bridge went live on the Saturday before the reports, roughly 12 hours before it was drained.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 28 Sept 2026, 06:01 UTC: Bitcoin.com News, official — 1 independent source, 1 reports
- 28 Sept 2026, 06:03 UTC: Bitcoin Insider — 2 independent sources, 2 reports
- 28 Sept 2026, 09:10 UTC: CryptoSlate — 3 independent sources, 3 reports
- 28 Sept 2026, 09:19 UTC: Cointelegraph — 4 independent sources, 4 reports
- 28 Sept 2026, 13:08 UTC: Protos — 5 independent sources, 5 reports
Affected entities
Also mentioned: South Korea
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | Scammers Launch Fake ETH L2 to Steal $2M From Crypto Traders | Original | |
| Cointelegraph Crypto media | Scammers steal $2M in ETH as fake GIWA network fools DYORSWAP | Independent | |
| Protos Crypto media | DYORSWAP users tricked into sending 767 ETH to fake bridge contract | Independent | |
| CryptoSlate Crypto media | Crypto scammers built an entire fake blockchain to steal over $2 million | Independent | |
| Bitcoin Insider Aggregator | Fake GIWA Blockchain Scam Nets Attackers Over $2 Million | Syndicated |
Related events
GIWA denies mainnet RPC leak, says mainnet has not launched
Crypto.News reports GIWA called a mainnet RPC leak impossible because its Ethereum Layer 2 mainnet is still under development and only testnet endpoints are published.
Dunamu and MoonPay explore stablecoin payments partnership
Upbit operator Dunamu and MoonPay agreed to explore a strategic collaboration on stablecoin payments, cross-border transfers, and GIWA blockchain services.
Sophon sets Nov 25 withdrawal deadline ahead of Nov 30 mainnet shutdown
Sophon announced a November 25 deadline for users to withdraw assets before its Ethereum layer-2 mainnet shuts down permanently on November 30.
XRP whale deposits to Binance hit 1.669 billion tokens, a seven-month high, as price slides toward $1.30
Large XRP holders moved approximately 1.669 billion tokens to Binance over 30 days, the highest inflow since March, while XRP traded near $1.30-$1.38.
XRP Tops Upbit Spot Volume in Korea as Upbit and Bithumb Delist Zilliqa
XRP led Upbit's won-pair spot volume over bitcoin and ether on Oct. 15 and 16, and separately Upbit and Bithumb said they will end support for Zilliqa's ZIL token.
