Fake GIWA bridge: 1,331 wallets paid in, and all 766 ETH went to Tornado Cash
PublicAML · On-chain investigation · 29 September 2026
On 26–27 September 2026 someone stood up a fake "GIWA mainnet" — a copy of Upbit’s layer-2, which has not launched — with its own RPC and bridge, and DyorSwap listed it. People bridged real ETH from Ethereum to get in early. We counted 1,331 wallets that sent 2,136 deposits into the fake bridge over thirteen hours. At 07:29 UTC on 27 September the bridge’s owners took everything in it, 766.25 ETH (about $2 million). By the morning of 28 September all of it had gone into Tornado Cash through five branches.
1,331
wallets deposited into the fake bridge, 26–27 Sep
766.25 ETH
taken by the bridge’s own 2-of-2 multisig
~765 ETH
in Tornado Cash within 27 hours, five branches
1.86 ETH
deposited after the theft, stuck in the bridge
How it worked
The bridge, 0xbA9938C0b96A70E6479661B915e7E481fE435ab2, was a proxy that pointed at the real OptimismPortal code, so on a block explorer it looked like a standard OP-stack bridge. What mattered was who could change it: a 2-of-2 Gnosis Safe, 0xccC2aeCf5d24f0eA30cf81Ec0dBEC59F19DdCD10, owned by 0x119e68B59C44291F76324c76377B776D0b4Dd38c and 0x0f3498258819bECE3F47661B3E331BD36c1CF857. The first owner deployed both on 26 September between 18:07 and 18:10 UTC. The first deposit arrived at 18:18.
At 07:29 UTC on 27 September both owners signed one transaction that upgraded the bridge to their own code, sent its entire balance — 766.25 ETH — to 0x04a9c8D8FEe491411Bda28b68aD80F0122Fc4134, and set the code back to the original, all in one step. @apoorveth was first to show this transaction; the chain confirms it.
GIWA has said its mainnet is not live and none of its contracts were involved. DyorSwap has said its own contracts were not compromised and has begun compensating users from its treasury (more than 200 ETH by its account).
Where the 766 ETH went
Within minutes the receiving wallet began splitting the ETH. 0x04a9c8D8FEe491411Bda28b68aD80F0122Fc4134 sent 227 ETH straight into Tornado Cash, 287 ETH through 0xEC160acd00D95EbbBE0394161101eb577CA96b60 and 251 ETH to 0x8c563fc543f6ecC2C8c09eB09D82798f7a7F3dA4, which passed it to 0xd5af44dd7c5F0e8C95d88713bfaBCc351E06A8Ee. That wallet put 190 ETH into Tornado and sent the last 60 ETH to 0xCc028B20Bdfcb1bFa5f48bBa0f935574Fb2CbA64, which deposited 30 ETH and passed 30 to 0x9cBAD8669bd9964BE71BC99e1725dF1c67949a70 for the final three deposits on 28 September.
Nothing is left to freeze: all but gas went into Tornado Cash by 11:18 UTC on 28 September. The wallets that route money to the attackers are now being sent fake "ETH" tokens from look-alike addresses — address poisoning, not counted here.
| When (UTC, 2026) | From | To | Amount | Tx |
|---|---|---|---|---|
| 26 Sep 18:10 | 0x119e68…4Dd38c | 0xbA9938…435ab2 | bridge deployed fake bridge created | 0x151466…3e0c9a |
| 27 Sep 07:29 | 0xbA9938…435ab2 | 0x04a9c8…Fc4134 | 766.25 ETH the bridge emptied by its owners | 0x1f3c0a…dc7306 |
| 27–28 Sep | 0x04a9c8…Fc4134 | 0xd90e2f…24F31b | 227.1 ETH into Tornado Cash | 0x20f541…57bbeb |
| 27 Sep 08:21–16:38 | 0xEC160a…A96b60 | 0xd90e2f…24F31b | 287.8 ETH into Tornado Cash | 0x33a295…1dae9d |
| 27 Sep 07:41 | 0x04a9c8…Fc4134 | 0x8c563f…7F3dA4 | 251 ETH relay wallet | 0x3429ea…9120b2 |
| 28 Sep 05:51–11:18 | 0xd5af44…06A8Ee | 0xd90e2f…24F31b | 190 ETH into Tornado Cash | 0xafa00e…d34003 |
| 28 Sep 09:20–10:52 | 0x9cBAD8…949a70 | 0xd90e2f…24F31b | 30 ETH into Tornado Cash | 0xaaf77c…7fe52b |
What this page does not say
It names nobody. The gas that deployed the Safe and the bridge came from a busy, unlabelled wallet that behaves like a swap service’s hot wallet; that is a lead for the service, not an accusation of it.
About 16.7 ETH of the 766 reached the bridge through contracts rather than directly from people’s wallets, so the true number of depositors is somewhat higher than 1,331.
All ten addresses on this page are listed on our incident page for this event, so anyone checking one of them finds the case.
Sources: Ethereum chain data (Blockscout) and the Safe’s owners and threshold read directly from the contract on 29 September 2026; the drain transaction as first shown by @apoorveth; GIWA’s and DyorSwap’s statements of 27 September. Dollar values at the late-September ETH price. This is an information resource about transactions between addresses, not financial or legal advice, and it names no individual as responsible for anything.