Fake Upbit GIWA bridge drains $2.07m from early users

What happened

Scammers stood up a fake network using the real chain ID, 9134, of GIWA, the Ethereum layer 2 tied to the Korean exchange Upbit, whose mainnet had yet to launch. Users bridged ETH into its bridge contract on Ethereum, and at 07:29:59 UTC on 27 September 2026 a single transaction moved 766.25 ETH, about $2.07m, out of it, 11 minutes after GIWA warned a second time that its mainnet had yet to launch.

The loss values the 766.254042 ETH drained at Chainlink's ETH/USD price of $2,706.30 in the drain block. GIWA posted warnings at 06:09 and 07:18 UTC that day. DYORSWAP, the exchange that had listed the fake network because it carried GIWA's real chain ID, said it would compensate users from its own treasury: 40% of the bridged amount for addresses that bridged under 5 ETH, with larger addresses reviewed one by one. Between 13:13 and 16:42 UTC on 27 September it paid 188.13 ETH, about $510,700 at Chainlink's $2,714.76, across 13 batch transfers. That compensation comes from DYORSWAP's treasury, and the drained ETH stayed with the attacker: Bitquery's investigation of 28 September counts 584.9 ETH, about $1.58m at the drain-block price, sent to Tornado Cash within 27 hours of the drain.