Fake Blockchain Scam Stole Over $2 Million in ETH
Crypto scammers built an entire fake blockchain to steal over $2 million from unsuspecting users. The attackers created a counterfeit version of the GIWA blockchain, which was being developed by Dunamu, operator of South Korea's largest crypto exchange, Upbit.
The fake network appeared to be GIWA's anticipated Ethereum Layer 2 mainnet, complete with an RPC endpoint, cross-chain bridge, and Chain ID 9134. However, the production network remained under development, and GIWA's documentation listed only its Sepolia testnet.
Attacks waited for deposits before changing the bridge. On-chain data suggests the attackers spent hours preparing the infrastructure before the first significant deposits arrived. Over 1,333 wallets deposited a combined 767 ETH worth about $2 million before the operators changed the bridge's portal code and drained almost all of it.
The attack relied in part on how EVM networks are identified. A Chain ID can tell a wallet which network it is connected to, but it does not verify who controls the RPC endpoint or bridge behind that network.