Scammers Drain $2M with Fake Blockchain Impersonating Real Project

A group of scammers created an entire fake blockchain to impersonate the GIWA mainnet, a Layer 2 developed by Dunamu, the parent company behind South Korea's largest crypto exchange, Upbit. The fraudulent network posed as the real GIWA network, using the correct chain ID, and even featured a functional cross-chain bridge, compatibility layer built on OP Stack technology, and batcher to process transactions.

The scammers launched their counterfeit Ethereum L2 on September 26, using chain ID 9134, which is the legitimate identifier reserved for the real GIWA network. They then got DYORSWAP, a decentralized exchange, to list the fake network as the genuine GIWA mainnet, making deposits accelerate.

Roughly 767.65 ETH flowed across the bridge before the attackers moved to drain wallets, siphoning off approximately 766.25 ETH in total. By September 27, GIWA publicly confirmed that its official mainnet had not launched and that any associated RPCs or infrastructure claims were entirely fabricated.