Scammers steal over $2M by creating fake GIWA blockchain

Summary

Scammers have successfully defrauded users of over $2 million by creating a fake GIWA blockchain and tricking them into sending more than 766 ETH via a fraudulent bridge. GIWA is a legitimate Ethereum L2 backed by Upbit, which was preparing for its mainnet launch, but these criminals exploited the anticipation by copying GIWA’s Chain ID and establishing a functional RPC and false bridge that gave the appearance of legitimacy. The scam was further bolstered by the involvement of affected platforms like DYOR Swap, which have committed to using treasury funds to compensate affected users as they investigate the fraudulent activities.

Analysis

GIWA: GIWA is a legitimate Ethereum Layer 2 blockchain project developed by Dunamu, the operator of the South Korean exchange Upbit, and built on Optimism’s OP Stack with one-second block times and EVM compatibility. Its Sepolia testnet has been live for developer testing, while the mainnet remains unlaunched as of late September 2026. Scammers exploited anticipation around its launch by copying its chain ID to deploy a fake RPC and bridge, prompting GIWA to publicly confirm the mainnet status and warn users. Upbit: Upbit is South Korea’s largest cryptocurrency exchange, operated by Dunamu, with a focus on expanding into blockchain infrastructure through projects like the GIWA Ethereum L2. It partnered with the Optimism Foundation to operate GIWA under a self-managed model, giving it control over key network components while receiving technical support. The exchange’s connection to GIWA was central to the recent scam that impersonated the unlaunched chain. DYOR Swap: DYOR Swap is a decentralized exchange that had listed what appeared to be the GIWA mainnet, allowing users to interact with the fraudulent network through its platform. The listing inadvertently lent credibility to the scam, which used GIWA’s correct chain ID on a fake bridge. Following the incident, the platform confirmed the network was fake, used its own funds for initial reimbursements, and announced plans to draw from treasury reserves to compensate affected users after investigation. Scam Tactics: Impersonators can deploy functional fake networks that mimic official chain parameters like RPC endpoints and bridges, enabling wallet connections and transactions that drain real assets before official launches occur. Platform Response: Affected platforms such as DYOR Swap are addressing impersonation incidents by committing treasury resources to user compensation while conducting on-chain investigations into fraudulent deployments. Infrastructure Development: Upbit-backed GIWA is among exchange-led efforts to build custom Ethereum L2s using the OP Stack for improved transaction speeds and accessibility ahead of mainnet.

Categories

cryptoethereumdefi

Related sources

View Original Tweet