GIWA blockchain impersonation scam steals $2 million

Scammers have successfully stolen approximately $2 million in cryptocurrency by constructing a counterfeit Ethereum Layer 2 blockchain. The fraudulent network impersonated the GIWA mainnet, a project being developed by Dunamu, the parent company of South Korea’s largest cryptocurrency exchange, Upbit.

The attackers utilized the legitimate Chain ID 9134, which is reserved for the actual GIWA network, to create a sense of authenticity. The fake infrastructure included a functional cross-chain bridge, a batcher, and compatibility with the OP Stack. This allowed the scammers to lure 1,333 to 1,335 wallets into depositing roughly 767 ETH before draining the funds.

Complications arose when the decentralized exchange DYORSWAP inadvertently listed the fraudulent network as the genuine GIWA mainnet, accelerating user deposits. DYORSWAP has since acknowledged its role in the incident and stated it is moving to compensate affected users from its own treasury. GIWA has confirmed that its official mainnet has not yet launched and that no native token for the project exists.