Fake GIWA mainnet drains 767 ETH from 1,333 wallets

Scammers created a counterfeit version of the GIWA mainnet, presenting an RPC endpoint, a cross-chain bridge and the expected Chain ID 9134. The fake network attracted 1,333 wallets that bridged a combined 767 ETH, and operators withdrew about 766 ETH.

On-chain investigator Stablemark traced the operation. Wallets linked to the scheme were funded via ChangeHero on Sept. 26. Eleven hours later, a Safe wallet controlling the fake bridge became active. Over the next 13 hours, the 1,333 wallets bridged funds into the counterfeit environment. Stablemark reported the operators then changed the bridge’s controlling code and removed 766 ETH in a single transaction.

GIWA, developed by Dunamu using Optimism’s OP Stack, posted that claims of a leaked production RPC were false and that no mainnet RPC exists. Project documentation lists only a Sepolia testnet instance using Chain ID 91342; the production network remains under development.

The attackers relied on how EVM networks are identified. A Chain ID tells a wallet which network it is connected to but does not verify who controls the RPC endpoint or the bridge processing transactions. By using the expected Chain ID 9134, the counterfeit environment appeared consistent with the anticipated mainnet while its operators retained control of the infrastructure receiving user funds.

Stablemark’s tracing showed 177 ETH was routed through Tornado Cash, a service that mixes funds to obscure origins, while roughly 589 ETH remained split across four wallets at the time of the update. Further transfers to mixers, exchanges or other services could reduce options for freezing or recovering the assets.

Members of the DYORSWAP community were among those who initially bridged assets to the fake chain. DYORSWAP warned users about unofficial RPC endpoints, bridges and contracts and posted: “The fake network used the correct GIWA Chain ID (9134), which made it appear legitimate during our initial verification. We have also identified specific suspicious messages and individuals in the related community that may be connected to this incident.”

DYORSWAP has opened a partial compensation process after reviewing affected addresses. Wallets that bridged less than 5 ETH are eligible for 40% of their cross-chain amount. Claims involving more than 5 ETH will be reviewed individually and require identity and address verification. The project published an address for compensation distributions and advised users to verify any reimbursement instructions through official channels.

DYORSWAP said it is preserving RPC logs, bridge addresses, transaction records and community communications to assist investigators reconstructing how the fraudulent network spread.