Scammers steal over $2M by creating fake GIWA blockchain

A group of scammers built an entire fake blockchain, complete with a bridge, a batcher, and OP Stack compatibility, to impersonate a real project that hadn’t even launched yet. The result: approximately 766 ETH drained from 1,335 addresses, with community estimates putting total losses near $2M. The fraudulent network posed as the GIWA mainnet, a Layer 2 developed by Dunamu, the parent company behind South Korea’s largest crypto exchange, Upbit. GIWA’s actual mainnet hasn’t gone live. The scammers just got there first. How the scam worked On September 26, the attackers launched their counterfeit Ethereum L2 using chain ID 9134, the legitimate identifier reserved for the real GIWA network. That single detail, the correct chain ID, turned out to be the linchpin of the entire operation. The fake chain featured a functional cross-chain bridge that accepted ETH deposits from Ethereum mainnet, a compatibility layer built on OP Stack technology, and a batcher to process transactions. Things got worse when DYORSWAP, a decentralized exchange, inadvertently listed the fraudulent network as the genuine GIWA mainnet. With a legitimate DEX pointing users toward the fake chain, deposits accelera...