$2M Stolen in Ethereum as Scammers Build Fake Blockchain to Mimic Upbit's GIWA

Crypto scammers have outdone themselves this time by building an entire fake blockchain to steal $2 million in Ethereum. The counterfeit version of GIWA, a Ethereum Layer 2 being developed by Upbit's operator Dunamu, was so convincing that it fooled DYORSWAP, a multichain DEX, into listing it as the real mainnet.

The scammers created an RPC endpoint, bridge, and OP Stack-style infrastructure, making it look like a legitimate network. They even used the correct Chain ID 9134, which is tied to the planned GIWA launch. This detail was enough to make wallets believe they were talking to the real Upbit chain.

The scammers pulled off their scheme over the weekend, bringing in around 767 ETH from 1,335 addresses before emptying the bridge and making off with $2 million in a single transaction. The stolen funds are already being moved, with some of it going through Tornado Cash.

DYORSWAP has since apologized for its role in the scam, saying it initially treated the fake chain as legitimate due to the correct Chain ID. It's now working to reimburse users who lost money and is tracing the bridge deployer and other parties involved in the scheme.