preferred on
Points of Focus
- DyorSwap said a fraudulent GIWA network used chain ID 9134, the identifier its team expected, helping it pass the DEX’s initial verification.
- GIWA’s official documentation still showed its mainnet as under development, with GIWA Sepolia and chain ID 91342 available for testing.
- 1,335 addresses bridged 767.65 ETH into the fake network, and 766.25 ETH was removed. More than 200 ETH has since been distributed to affected users.
DyorSwap said 766.25 Ether (ETH) was removed after 1,335 addresses bridged funds into a fraudulent network the decentralized exchange (DEX) had treated as GIWA’s mainnet.
In a Sept. 27 disclosure, the multichain DEX stated that the fake network used chain ID 9134, matching the identifier its team expected for GIWA and helping the chain pass its initial verification.
⚠️ Security Incident Notice
We have confirmed that the so-called GIWA Mainnet we previously identified was in fact a fake chain set up by scammers.
The fake network used the correct GIWA Chain ID (9134), which made it appear legitimate during our initial verification. We have…
— DYORSWAP (@DYORSWAPDEX) September 27, 2026
GIWA’s official network page still described the mainnet as under development and listed GIWA Sepolia — chain ID 91342 — as the available test network. Its contract documentation contained testnet addresses, while mainnet contract information remained unavailable.
Fake GIWA mainnet looked like a functioning layer 2
In its reconstruction of the incident, DyorSwap described a network equipped with a bridge and batcher resembling layer-2 infrastructure. The platform also identified early transactions it interpreted as testing activity before larger amounts began moving through the bridge.
A chain ID alone does not authenticate a network because an Ethereum Virtual Machine chain can be configured to use a chosen numerical identifier. Stronger verification can include official remote procedure call (RPC) endpoints, contract addresses, bridge deployments, and launch announcements.
GIWA’s records provided those reference points for Sepolia, including an official RPC endpoint and deployed testnet contracts. No equivalent mainnet details had appeared.
In the $285-million Drift Protocol exploit, assets moved through cross-chain systems soon after the compromise, while investigators continued tracing funds after the Coldcard-linked Bitcoin (BTC) theft.
A US Federal Bureau of Investigation agent accused of stealing crypto allegedly used sensitive access as part of the scheme, exposing another weakness around privileged access.
1,335 addresses bridged nearly 768 ETH
DyorSwap reported that 1,335 addresses bridged about 767.65 ETH into the fraudulent GIWA chain, with 766.25 ETH later removed. The platform said its own contracts remained intact and attributed the loss to the fake network and the verification process that allowed users to interact with it.
More than 200 ETH has since been distributed from DyorSwap’s own funds, while remaining claims are still being reviewed. Its investigation is following the bridge deployer, funding source, early wallets, and destination of the removed ETH.
Recovery becomes harder once native assets move between attacker-controlled addresses. Circle has previously frozen USDC (USDC) wallets through its issuer-controlled blacklist function.
ETH has no comparable issuer-level control, leaving tracing, exchange cooperation, and legal action among the main routes described in the broader limits of freezing crypto.
Share
Most read articles
