Fake GIWA Chain Scam Results in $2 Million Loss
A fraudulent network masquerading as GIWA Mainnet led to significant losses for users. Approximately 766.25 ETH was drained from a fake bridge after users deposited real Ethereum.
Our full investigation: Fake GIWA bridge: 1,331 wallets paid in, and all 766 ETH went to Tornado Cash
On September 27, 2026, a multi-chain decentralized exchange (DEX) named DYORSWAP listed a network that was falsely presented as GIWA Mainnet, identified by chain ID 9134. This network was a scam, built by fraudsters, and included a fraudulent bridge that misled users into depositing genuine Ethereum-mainnet ETH. The operators of this fake chain subsequently drained around 766.25 ETH, equating to approximately $2,000,000.
The official GIWA project, which is linked to Upbit and operates as a Layer 2 solution, clarified that its mainnet was not live at the time of the incident. In response to the situation, DYORSWAP stated that its own contracts were not compromised. They initiated a treasury compensation process for affected users and have already reimbursed more than 200 ETH, with ongoing efforts to trace the remaining funds.
This incident highlights the risks associated with engaging with unverified networks and bridges in the cryptocurrency space. The involvement of a legitimate DEX in the listing of a fraudulent chain raises concerns about due diligence in the crypto ecosystem.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0xba9938c0b96a70e6479661b915e7e481fe435ab2 | ETH | mentioned in coverage | Check live |
| 0xccc2aecf5d24f0ea30cf81ec0dbec59f19ddcd10 | ETH | mentioned in coverage | Check live |
| 0x119e68b59c44291f76324c76377b776d0b4dd38c | ETH | mentioned in coverage | Check live |
| 0x0f3498258819bece3f47661b3e331bd36c1cf857 | ETH | mentioned in coverage | Check live |
| 0x04a9c8d8fee491411bda28b68ad80f0122fc4134 | ETH | mentioned in coverage | Check live |
| 0xec160acd00d95ebbbe0394161101eb577ca96b60 | ETH | mentioned in coverage | Check live |
| 0x8c563fc543f6ecc2c8c09eb09d82798f7a7f3da4 | ETH | mentioned in coverage | Check live |
| 0xd5af44dd7c5f0e8c95d88713bfabcc351e06a8ee | ETH | mentioned in coverage | Check live |
| 0xcc028b20bdfcb1bfa5f48bba0f935574fb2cba64 | ETH | mentioned in coverage | Check live |
| 0x9cbad8669bd9964be71bc99e1725df1c67949a70 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.
