Attackers built a counterfeit version of the Upbit-backed GIWA blockchain and extracted 766 ETH from 1,333 depositing wallets in a single transaction on September 26, according to analysis by pseudonymous blockchain researcher Stablemark.
The operation exploited the fact that GIWA’s mainnet had not yet launched. Scammers created a fake network using Chain ID 9134, the identifier expected for GIWA’s production environment. They stood up a valid RPC endpoint and bridge, making the infrastructure appear legitimate to users unfamiliar with the network’s actual status.
Within approximately 13 hours of the bridge going live, 1,333 wallets deposited a combined 767 ETH into the fake network. Operators then changed the bridge portal’s controlling code and drained 766 ETH in a single transaction.
DYORSWAP, a project whose community members were among those who interacted with the fake network, said the attack succeeded partly because of the correct Chain ID. “The fake network used the correct GIWA Chain ID (9134), which made it appear legitimate during our initial verification. We have also identified specific suspicious messages and individuals in the related community that may be connected to this incident,” DYORSWAP stated.
A Chain ID tells a wallet which network it is connected to but does not verify who controls the RPC endpoint or bridge. GIWA’s legitimate documentation lists only GIWA Sepolia (Chain ID 91342) as available; the production network remains under development. GIWA stated that claims its production RPC had leaked were false because no mainnet RPC exists.
On September 26, wallets tied to the operation were funded through ChangeHero, a cryptocurrency exchange service. A Safe wallet and fake bridge went live approximately 11 hours later.
Of the 766 ETH drained, 177 ETH was routed through Tornado Cash, a mixing service that obscures transaction origins. At the time of Stablemark’s analysis, 589 ETH remained distributed across four wallets.
DYORSWAP announced a compensation program offering 40% reimbursement to wallets that bridged less than 5 ETH. The project is preserving RPC records, bridge addresses, transaction data, and community communications for investigators.
GIWA was announced in May by Dunamu, which operates Upbit, and the Optimism Foundation as the first Self-Managed OP Enterprise chain. The design allows Upbit to retain operational control while Optimism provides backup infrastructure and support.
