Fake GIWA chain ID 9134 drains ~766 ETH; DYORSWAP pays 200+ ETH
By Crypto Wire
September 28, 2026
A working fake Layer 2—not a phishing page—impersonated the unreleased GIWA mainnet, reused chain ID 9134, and drained about 766.25 ETH after 1,335 addresses bridged roughly 767.65 ETH into it, per multichain DEX DYORSWAP’s reconstruction amplified by Lookonchain and wrapped on September 28 by The Crypto Times. DYORSWAP says this was not a DYOR contract exploit: the operators controlled the fraudulent bridge, emptied the real ETH backing the fake L2, and left in-chain balances—including DYOR liquidity—without the same redemption support. The desk attributes those deposit, drain, and compensation figures as DYORSWAP claims reconstructed from on-chain batches, not as a court finding.
How the spoof passed a first look. GIWA—an Ethereum L2 tied to Dunamu / Upbit in secondary coverage—had not launched mainnet; its docs still mark mainnet “under development,” with public endpoints for GIWA Sepolia only. Attackers stood up an OP Stack–style network that accepted ETH from Ethereum, ran a batcher posting data back to mainnet, and used the reserved chain ID 9134. Chain IDs are not exclusively owned: any EVM operator can declare the number, so a pre-launch reservation is a spoof window, not a lock. CryptoBriefing adds that DYORSWAP listed the fraudulent network as genuine GIWA mainnet, which accelerated deposits—treat that listing claim as secondary reporting of the DEX’s role, which DYORSWAP itself frames as being affected by the fake network rather than as the drain operator.
Timeline DYORSWAP reconstructed. The fraudulent bridge deployed at 02:10:59 UTC+8 on September 27, 2026 (Ethereum block 26063331), after the deployer received about 0.045 ETH from an address DYORSWAP links to instant exchange ChangeHero. Thirty-nine blocks later, three same-second deposits totaling 0.4 ETH arrived; two were first-ever outflows from those wallets, which DYORSWAP calls “strongly consistent” with pre-positioned test wallets—an on-chain behavioral read, not proof of identity. The siphon hit block 26067309 for about 766.25 ETH. Because the fake L2 posted batches to Ethereum, DYORSWAP says it re-executed surviving batch data to rebuild deposits, trades, and pools after the fake chain died—spot checks matched live pre-shutdown data within about 1.6%, with a ~two-minute gap for unposted final blocks.
Compensation while the hunt continues. DYORSWAP says it has already paid more than 200 ETH from its own funds to affected users and that those transfers are reviewable on-chain. A separate PANews wrap of DYORSWAP’s plan said addresses that bridged under 5 ETH were set for 40% compensation after review, with some larger addresses flagged for separate phishing/fraud checks and an official compensation address published—attribute the 40% / size-cutoff rules as that company update, not as a full reimbursement of the 766 ETH drain. Investigation targets remain the deployer, funding path, test wallets, batcher kit, drain recipient, and later hops.
Why this unused LN over watchlist calendars. Solana Alpenglow still lacks a confirmed mainnet-live feature-gate flip—Anza’s Sep 28 entry is “begin feature activation,” and secondary desks still describe it as tentative, not proven live on mainnet-beta—so no UPDATE append to tracker 9852. Bitget’s BTC phase one already ran this morning (9902); next retail rung is ETH on September 29. Robinhood/Pons 9883 and California bills 9897 have no newer primary hop. The clean unused wire is the fake GIWA 9134 L2 plus DYORSWAP’s 200+ ETH compensation rebuild.
What collectors should take without inventing: official GIWA docs and Sep 27 clarifications say mainnet is not live—avoid unofficial RPCs, bridges, and “GIWA mainnet” adds in wallets. Do not invent that DYORSWAP’s contracts were the drain vector, that every victim is whole, that ChangeHero is a co-conspirator (DYORSWAP only links a funding hop), or that ~$2 million community loss estimates are audited accounting. Stick to DYORSWAP’s 1,335 / 767.65 / 766.25 / 200+ ETH figures, block markers, and GIWA’s not-launched stance.
Bottom line: a fake OP Stack–style GIWA mainnet on chain ID 9134 took about 766 ETH from 1,335 bridgers before DYORSWAP rebuilt the tape and paid 200+ ETH in self-funded compensation—Rug Room unused LN for Sep 28 OC.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
