Particle.news
Download on the App Store
3 ARTICLES
·
3w ago

Scammers Build Fake GIWA Layer 2 and Steal About 766 ETH

The attack exploited a gap in chain identity checks that let the counterfeit network collect deposits and has prompted a DEX to offer partial compensation and preserve records for investigators.

Image
GIWA official brand image
Scammers launch fake eth l2 to steal $2m from crypto traders

Overview

  • Attackers launched a fully functional counterfeit Layer 2 on Sept. 26 that used GIWA’s reserved Chain ID 9134 and a working RPC, bridge, OP Stack compatibility layer, and batcher to accept deposits.
  • Roughly 1,333 wallets bridged about 767 ETH into the fake environment before operators changed the bridge code and drained about 766 ETH in a single sweep.
  • On-chain tracing shows about 177 ETH moved through Tornado Cash while the rest remains in a handful of identifiable wallets as investigators and platforms continue tracking funds.
  • DYORSWAP, which initially listed the fraudulent chain, has preserved logs, credited over 200 ETH to larger victims, and offered a 40% reimbursement for deposits under 5 ETH while handling large claims case-by-case.
  • The case highlights a verification gap: Chain IDs do not authenticate who controls RPC endpoints or bridges, which means platforms and users must confirm official endpoints and avoid unofficial bridges to reduce fraud risk.