Fake GIWA L2 bridge: ~766 ETH drained from counterfeit OP Stack
Late Sep 2026: attackers stood up a fake GIWA mainnet (OP Stack-style, reserved chain ID 9134) while the real Dunamu/Upbit-backed L2 was still unlaunched.
A working bridge and batcher took deposits; roughly 1,335 addresses bridged about 767 ETH and attackers drained about 766 ETH (~$2M community estimate). DYORSWAP had listed the fake network, which sped deposits.
GIWA told users to ignore unofficial RPCs and bridges; DYORSWAP began compensating victims from its treasury. Research snapshot from CryptoBriefing and related public notes.
369 take
A reserved chain ID and a polished bridge UI are not a live project. Aggregator listings can launder a counterfeit L2.
Pulse lesson: only add RPCs and bridges from the project’s pinned domain; treat “mainnet soon” mirrors as phishing until the team confirms.
Sources