Counterfeit Ethereum Layer 2 Steals 766 ETH from GIWA Bridge Users

A recent incident on the Ethereum network highlights the importance of verifying the authenticity of new chains and bridges. Scammers drained over 766 Ethereum (ETH) from users who thought they were interacting with the official GIWA Bridge. The GIWA Bridge is an OP Stack project from Dunamu, the operator of South Korea's Upbit exchange.

The scam occurred when a counterfeit Ethereum Layer 2 posed as GIWA, reusing chain ID 9134 and publishing unofficial RPC endpoints. The fake network included OP Stack-style components, such as a bridge and a batcher, which made it appear as a functioning L2. The counterfeit bridge was listed on the DYORSWAP multi-chain DEX after passing an initial check, leading users to deposit ETH into the fake network.

Once the bridge went live, attackers withdrew about 766.25 ETH, leaving victims with significant losses. The DEX has since contacted security researchers, including SlowMist, and begun paying victims from its treasury. Over 200 ETH has already been distributed to affected users.

The incident serves as a reminder of the importance of verifying the authenticity of new chains and bridges. Until a project publishes official endpoints and contracts, a DEX listing is not proof that a chain is real.