CryptoSlate
Scammers lured 1,333 wallets into depositing 767 ETH, worth about $2 million, on a counterfeit version of the Upbit-backed GIWA blockchain, then drained 766 ETH in one transaction. The fake network mimicked GIWA’s anticipated Ethereum Layer 2 mainnet with an RPC endpoint and cross-chain bridge, and used Chain ID 9134. GIWA said its mainnet was not live and claims its production RPC had leaked were false.
Why it matters
A Chain ID helps wallets identify a network, but it does not verify who controls that network’s RPC endpoint or bridge. The attackers used the identifier associated with GIWA’s planned launch to make a fraudulent environment appear legitimate. GIWA’s documentation lists GIWA Sepolia at Chain ID 91342, while the production network remains under development.
Dunamu, Upbit’s operator, is developing GIWA with Optimism’s OP Stack. The planned chain is intended to let Upbit retain operational control, with the Optimism Foundation providing backup infrastructure and support. DYORSWAP, whose community initially interacted with the purported network, later warned users against unofficial RPC endpoints, bridges and contracts.
Market impact
On-chain analyst Stablemark said wallets linked to the operation were funded through ChangeHero on Sept. 26. The scheme’s controlling Safe wallet and fake bridge went live about 11 hours later; deposits followed over the next 13 hours. Stablemark said 177 ETH had been routed through Tornado Cash, while another 589 ETH remained spread across four wallets at the time of the update.
DYORSWAP offered affected wallets that bridged less than 5 ETH compensation equal to 40% of their cross-chain amount. Larger claims require separate review and identity and address verification. The project warned victims to confirm reimbursement details through official channels, as fake claims could target them again.
Frequently asked questions
-
How did the fake GIWA network appear legitimate to users?
It copied the anticipated network setup, including an RPC endpoint and bridge, and used Chain ID 9134, the identifier associated with GIWA’s planned mainnet.
-
What does a matching Chain ID verify, and what does it not verify?
A Chain ID helps a wallet identify a network. It does not verify who controls that network’s RPC endpoint or bridge.
-
Was GIWA’s production mainnet live during the scam?
No. GIWA said its mainnet was not live and that claims of a leaked production RPC were false. Its documentation lists GIWA Sepolia at Chain ID 91342.
-
How much ETH had moved through Tornado Cash?
Stablemark said 177 ETH had been routed through Tornado Cash. Another 589 ETH remained spread across four wallets at the time of the update.
-
What compensation did DYORSWAP offer affected users?
Wallets that bridged less than 5 ETH would receive compensation equal to 40% of their cross-chain amount. Larger claims require separate review and identity and address verification.
TheBlock
CoinDesk
WatcherGuru
WuBlockchain
Altcoin Daily
CoinTelegraph