BTC $82,917 
ETH $2,656 
USDT $0.9997 
BNB $761.92 
XRP $1.49 
USDC $0.9998 
SOL $118.57 
TRX $0.3343 
ZEC $1,558 
FIGR_HELOC $1.06Scammers Launch Fake ETH L2 to Steal $2M From Crypto Traders
A counterfeit Ethereum Layer 2 network impersonating an Upbit-backed project lured 1,333 users to deposit 767 ETH worth about $2 million before draining almost
The short answer
Scammers created a fake Ethereum Layer 2 network pretending to be the upcoming GIWA mainnet, a project backed by South Korean exchange Upbit. The fraudulent chain used the correct planned Chain ID for GIWA to appear legitimate, luring 1,333 users to deposit 767 ETH worth roughly $2 million. Operators drained 766 ETH in a single transaction after accumulating deposits over 13 hours.
What happened
Unidentified scammers built a full counterfeit blockchain impersonating GIWA, an Ethereum Layer 2 project backed by South Korean crypto exchange Upbit, to steal user funds. The fake network mimicked GIWA's planned mainnet with an RPC endpoint, cross-chain bridge, and the correct expected Chain ID 9134, tricking 1,333 wallets into depositing a combined 767 ETH worth about $2 million.
On-chain analysis from pseudonymous analyst Stablemark found the attackers funded related wallets via crypto exchange ChangeHero on September 26. Roughly 11 hours later, the Safe wallet controlling the fake bridge and scheme went live, and over the next 13 hours, users deposited their funds. Once enough ETH was accumulated, the operators changed the bridge's portal code and drained 766 ETH in a single transaction.
DYORSWAP, the multichain decentralized exchange whose community first interacted with the fake network, confirmed the chain was fraudulent and warned users against unofficial GIWA RPC endpoints, bridges and contracts. The project noted the fake chain used the correct GIWA Chain ID 9134, which made it appear legitimate during initial verification.
Why it matters
The attack highlights a new, sophisticated scam vector targeting Ethereum Layer 2 networks, as the fake chain included full OP Stack-style infrastructure rather than a simple fake address. GIWA, which is being developed by Upbit operator Dunamu using Optimism's OP Stack, had not yet launched its mainnet at the time of the scam, with its documentation only listing a Sepolia testnet using Chain ID 91342.
The scam also raised questions about user safety on decentralized platforms, as some users criticized DYORSWAP for its role in the incident, arguing the project's promotion of the chain led users to deposit funds. DYORSWAP has since launched a compensation program, distributing over 200 ETH from its own funds to affected users. Wallets that bridged less than 5 ETH will receive 40% of their cross-chain amount, while claims for more than 5 ETH require identity and address verification.
What is still unclear
- The full destination of the stolen funds remains unclear, as 177 ETH was routed through the crypto mixer Tornado Cash, and the remaining 589 ETH spread across four wallets could be moved to mixers, exchanges or other services at any time.
Questions readers ask
What fake Ethereum Layer 2 network did scammers launch in the $2M theft?
The fake network impersonated GIWA, an upcoming Ethereum Layer 2 project backed by South Korean crypto exchange Upbit. It used the correct planned Chain ID 9134 for GIWA's mainnet, along with an RPC endpoint, cross-chain bridge and OP Stack-style infrastructure to appear legitimate.
How much ETH was stolen in the fake GIWA L2 scam?
Attackers drained approximately 766 ETH worth over $2 million from 1,333 user wallets after they deposited funds to the fake chain's bridge.
Is DYORSWAP compensating users affected by the fake GIWA chain scam?
Yes, DYORSWAP has launched a compensation program and has already distributed over 200 ETH from its own funds. Users who bridged less than 5 ETH will receive 40% of their cross-chain amount, while larger claims require identity and address verification.
