Fraudsters drained more than 766 ETH—valued by the community at roughly $2 million—by launching a counterfeit Ethereum Layer 2 that posed as GIWA before the real network ever went live. GIWA is an OP Stack project from Dunamu, the operator of South Korea’s Upbit exchange.
Official accounts have been clear that mainnet is still unfinished and that only Sepolia testnet infrastructure exists.
Scammers filled that vacuum with a look-alike chain that reused chain ID 9134, published unofficial RPC endpoints, and offered a bridge that accepted real ETH from Ethereum.
The fake network was not a simple phishing site.
It included OP Stack-style components, among them a bridge and a batcher that posted batches back to Ethereum, so wallets and explorers treated it as a functioning L2.
— DYORSWAP (@DYORSWAPDEX) September 27, 2026
DYORSWAP, a multi-chain DEX, listed the impostor as GIWA mainnet after the matching chain ID passed an initial check.
Once the listing went live, users treated the bridge as official infrastructure and began depositing.
DYORSWAP later published on-chain reconstruction.
The fraudulent bridge at 0xbA9938C0b96A70E6479661B915e7E481fE435ab2 was deployed from 0x119e68B59C44291F76324c76377B776D0b4Dd38c at 02:10:59 UTC+8 on 27 September 2026.
About 8.5 hours earlier the deployer received a small ETH transfer from an address linked to ChangeHero.
Shortly after the bridge went live, several small test deposits arrived in the same second from wallets that looked like internal probes.
In total, 1,335 addresses sent about 767.65 ETH across the bridge.
Attackers then withdrew about 766.25 ETH.
The DEX has said this was not a vulnerability in its own contracts.
It and its users were both caught by an impersonation of an unreleased chain.
The platform preserved chat logs, RPC data, bridge addresses, and transaction records, contacted security researchers including SlowMist, and began paying victims from its treasury.
More than 200 ETH has already been distributed.
Addresses that bridged under 5 ETH were offered 40 percent reimbursement; larger deposits are being reviewed separately because some may be tied to the operators.
GIWA’s official account warned the same day that mainnet is not running and that any claimed mainnet RPC is false.
The incident shows how little is required to manufacture a believable L2: a reserved chain ID, public OP Stack tooling, and a listing that other traders treat as confirmation. Until a project publishes official endpoints and contracts, a DEX listing is not proof that a chain is real.
