Fake GIWA Mainnet Scam Drains $2 Million from DYORSWAP Users
A fraudulent GIWA mainnet tricked users into bridging ETH, resulting in a $2 million loss.
Our full investigation: Fake GIWA bridge: 1,331 wallets paid in, and all 766 ETH went to Tornado Cash
Scammers created a fake GIWA mainnet using the planned official Chain ID 9134, deceiving users into bridging ETH from the Ethereum mainnet. This was facilitated through DYORSWAP’s integrated fraudulent bridge and RPC. The official GIWA mainnet has not yet launched, indicating that the bridge was entirely illegitimate.
As a result of this scam, funds were drained from the fake bridge contract, leading to a total loss of $2 million. The incident highlights the risks associated with unverified projects and the potential for significant financial loss when users engage with fraudulent platforms.
The incident occurred on the Ethereum chain, which allows for the tracing of transactions. However, the specific addresses involved in the fraudulent activities were not provided in the description, limiting the ability to track the flow of the drained funds on-chain.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0xba9938c0b96a70e6479661b915e7e481fe435ab2 | ETH | mentioned in coverage | Check live |
| 0xccc2aecf5d24f0ea30cf81ec0dbec59f19ddcd10 | ETH | mentioned in coverage | Check live |
| 0x119e68b59c44291f76324c76377b776d0b4dd38c | ETH | mentioned in coverage | Check live |
| 0x0f3498258819bece3f47661b3e331bd36c1cf857 | ETH | mentioned in coverage | Check live |
| 0x04a9c8d8fee491411bda28b68ad80f0122fc4134 | ETH | mentioned in coverage | Check live |
| 0xec160acd00d95ebbbe0394161101eb577ca96b60 | ETH | mentioned in coverage | Check live |
| 0x8c563fc543f6ecc2c8c09eb09d82798f7a7f3da4 | ETH | mentioned in coverage | Check live |
| 0xd5af44dd7c5f0e8c95d88713bfabcc351e06a8ee | ETH | mentioned in coverage | Check live |
| 0xcc028b20bdfcb1bfa5f48bba0f935574fb2cba64 | ETH | mentioned in coverage | Check live |
| 0x9cbad8669bd9964be71bc99e1725df1c67949a70 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.