Scammers steal over $2 million through a fake GIWA blockchain

Scammers built a counterfeit version of GIWA's anticipated Ethereum Layer 2 mainnet. The scheme drew 1,333 wallets into depositing 767 ETH, worth about $2 million. Stablemark said the operators changed the bridge's portal code. Stablemark said they drained 766 ETH in a single transaction. The fake network used Chain ID 9134, which is associated with GIWA's planned launch. GIWA said claims that its production RPC had leaked were false. GIWA said no mainnet RPC exists. GIWA's documentation lists only GIWA Sepolia. GIWA Sepolia uses Chain ID 91342. GIWA's production network remains under development. DYORSWAP said the chain was fraudulent and warned users against unofficial RPC endpoints, bridges and contracts. DYORSWAP said it identified suspicious messages and individuals in the related community who may be connected to the incident. Dunamu, the operator of Upbit, is developing GIWA using Optimism's OP Stack. Dunamu and the Optimism Foundation announced in May that GIWA is planned as the first Self-Managed OP Enterprise chain. The plan would allow Upbit to retain operational control. Optimism would provide backup infrastructure and support. On-chain data suggested the attackers spent hours preparing infrastructure before significant deposits arrived. Stablemark said wallets tied to the operation were funded through ChangeHero on Sept. 26. About 11 hours later, the Safe wallet controlling the scheme and fake bridge went live. Over the next 13 hours, 1,333 wallets deposited a combined 767 ETH. Stablemark said the operators changed the bridge's portal code before draining 766 ETH in a single transaction. A Chain ID can identify which network a wallet is connected to. A Chain ID does not verify who controls the network's RPC endpoint or bridge. Stablemark said 177 ETH was routed through Tornado Cash. Stablemark said another 589 ETH remained across four wallets at the time of his update. Further transfers to mixers, exchanges or other services could narrow the window for investigators to freeze or recover the funds. DYORSWAP said wallets that bridged less than 5 ETH would receive compensation equal to 40% of their cross-chain amount. DYORSWAP said claims involving more than 5 ETH would be handled separately and require identity and address verification. DYORSWAP said some larger wallets could be linked to phishing or other fraudulent activity. DYORSWAP published an address for compensation distributions. DYORSWAP warned victims to verify the address through official channels because scammers could use fake reimbursement requests to exploit the incident. DYORSWAP said it is preserving RPC records, bridge addresses, transaction data and community communications as investigators reconstruct how the fraudulent network spread.