Fake GIWA Blockchain Tricks DYORSWAP Into Bridge Integration, Draining Nearly $2 Million In ETH

Fake GIWA Mainnet Bridge Drains Nearly $2 Million

The scam began with a blockchain that had not even launched.

More than 1,300 crypto users sent Ether into what they believed was an official GIWA mainnet bridge, after scammers created a fake network that DYORSWAP initially accepted as legitimate.

How Did Scammers Make The Fake GIWA Chain Look Real?

DYORSWAP, a multi-chain decentralised exchange, said 1,335 addresses transferred a total of 767.65 ETH to the fraudulent bridge.

Scammers later drained 766.25 ETH, worth about $2 million, leaving users facing losses after believing they were getting early access to GIWA.

The fake bridge was deployed shortly after 6pm UTC on Saturday and was emptied just over 12 hours later.

DYORSWAP said its own contracts were not compromised and that it was investigating the bridge deployer, funding sources, suspected test wallets and the addresses that received the stolen funds.

The deception worked partly because the fake network used the same chain ID, 9134, as the legitimate GIWA network.

DYORSWAP said this allowed the fraudulent chain to “appear legitimate during [DYORSWAP’s] initial verification.”

The exchange also referred to “specific suspicious messages” that may have helped spread false information about a GIWA mainnet launch among its community.

GIWA had not actually launched its mainnet.

The project, developed by Dunamu, the operator of South Korean crypto exchange Upbit, is an Ethereum layer-2 network built using Optimism’s OP Stack.

Its Sepolia testnet launched in September 2025, while its planned mainnet remained unavailable.

GIWA said on Sunday,

“We do not have our mainnet running currently.”

The project warned that mainnet connection details circulating online were false.

The warning came only minutes before the fake bridge was emptied.

More Than 1,300 Users Were Caught In The Scam

The scam spread quickly as users rushed to interact with what they believed was a newly launched blockchain.

The stolen funds were later funnelled into Tornado Cash, a cryptocurrency mixing service.

DYORSWAP has since published addresses it believes were linked to the scheme based on their timing and on-chain behaviour, with some of the wallets reportedly funded through Binance and Gate.

The exchange also said an address claiming to represent its team had contacted the scammers on-chain and requested the return of the funds.

https://t.co/u5MCU96ilE
— DYORSWAP (@DYORSWAPDEX) September 27, 2026
a

DYORSWAP Offers Compensation To Affected Users

DYORSWAP said it has used its own funds to distribute more than 200 ETH to affected users.

It also offered a 40% refund to users who bridged less than five ETH, while cases involving larger amounts are being assessed individually.

The exchange said it had initially mistaken the fraudulent chain for GIWA’s mainnet before discovering the deception.

The incident is particularly ironic because DYORSWAP takes its name from “do your own research”, a phrase widely used in crypto to encourage users to verify projects and information before committing funds.

In this case, the exchange itself initially failed to verify that the supposed GIWA mainnet was genuine, making the platform’s name an uncomfortable twist in the $2 million scam.