DYOR or DY-NOT: Forgers of Fake GIWA Chain Walk Off With $2M in ETH 🪤

A fraudulent bridge posing as the mainnet of GIWA, an Ethereum layer-2 network developed by Upbit operator Dunamu, siphoned roughly $2 million in Ether ($ETH) from users of decentralized exchange DYORSWAP. In a reconstruction published Monday, DYORSWAP said the fake bridge received about 767.65 ETH from 1,335 addresses before the operators drained 766.25 ETH.

GIWA confirmed on Sunday that its mainnet had not launched and warned that connection details circulating online were fake. "We do not have our mainnet running currently," the project wrote. Dunamu launched GIWA's Sepolia testnet in September 2025 using Optimism's OP Stack, and in April, Dunamu, Hana Financial and POSCO International agreed to test a GIWA Chain-based cross-border remittance system using real trade transactions.

DYORSWAP said it initially mistook the counterfeit bridge for the project's mainnet. The exchange stated its contracts had not been compromised and that it is tracing the bridge deployer, funding sources, suspected test wallets and the addresses that received the funds. To compensate affected users, DYORSWAP said it used its own funds to pay more than 200 ETH.

The incident has prompted renewed attention to bridge security across the Ethereum ($ETH) ecosystem as investigators work to identify the perpetrators and recover the stolen assets.