Scammers Drain $2M Through Fake GIWA Blockchain

Scammers have drained around $2 million in Ether from users who believed they were interacting with GIWA, an Ethereum layer-2 network whose mainnet has not yet launched.

According to a reconstruction by decentralized exchange DYORSWAP, a fraudulent bridge posing as GIWA’s mainnet received about 767.65 ETH from 1,335 addresses. The attackers later drained 766.25 ETH from the bridge.

The fake network was built to resemble the infrastructure expected for GIWA, including an RPC endpoint, a cross-chain bridge, and a blockchain identifier. DYORSWAP initially treated it as GIWA’s mainnet before determining that the network was fraudulent. GIWA confirmed that its mainnet is not currently live and warned users that purported mainnet connection details circulating online were false.

GIWA is being developed by Dunamu, the operator of South Korean crypto exchange Upbit. Its publicly available network is currently the GIWA Sepolia testnet, which uses test assets rather than real funds.

DYORSWAP said its own contracts were not compromised and that it is tracing the bridge deployer, funding sources, suspected test wallets, and the addresses that received the stolen ETH. The exchange has also used its own funds to compensate affected users, paying out more than 200 ETH so far.