DYORSWAP, a multi-chain decentralized exchange, said the losses tied to the so-called fake GIWA Mainnet 9134 incident did not stem from an attack on its own contracts. In a statement released on Sept. 28, the team said both the project and its users were affected by a fraudulent network impersonating GIWA Mainnet 9134. According to DYORSWAP, the fake network deployed an OP Stack-like bridge and batcher on Sept. 27, 2026, at 02:10:59 UTC+8. Roughly 8.5 hours before deployment, the address involved received about 0.045 ETH from an address linked to ChangeHero. The bridge then saw three deposits totaling 0.4 ETH in the same second after just 39 blocks, with two of them being the first outgoing transfers from those wallets. DYOR said the pattern strongly matched internal test-wallet characteristics. On-chain data cited by the team showed that 1,335 addresses sent about 767.65 ETH into the bridge, and about 766.25 ETH was ultimately drained. The outflow transaction took place in Ethereum block 26067309. DYORSWAP said it has already paid more than 200 ETH from its own funds to affected users and that its investigation remains ongoing.
DYORSWAP, a multi-chain decentralized exchange, said the losses tied to the "fake GIWA Mainnet 9134" incident were not caused by an attack on DYORSWAP contracts.
In a statement released on Sept. 28, the team said both the project and its users were affected by a fraudulent network impersonating GIWA Mainnet 9134.
Deployment timeline and early funding activity
According to the statement, the fake network deployed an OP Stack-like bridge and batcher at 02:10:59 on Sept. 27, 2026, in UTC+8.
About 8.5 hours before deployment, the address involved received roughly 0.045 ETH from an address related to ChangeHero, DYORSWAP said.
After the bridge went live, only 39 blocks passed before three deposits totaling 0.4 ETH entered in the same second. Two of those transactions were also the first outgoing transfers from those wallets. DYOR said the addresses closely matched the characteristics of internal test wallets.
Funds sent through the bridge
The fake L2 then continued operating and published transaction batches to Ethereum mainnet.
Data cited by DYORSWAP showed that 1,335 addresses transferred about 767.65 ETH into the bridge, and around 766.25 ETH was ultimately drained. The draining transaction occurred in Ethereum block 26067309.
Compensation and ongoing probe
The DYOR team said it has distributed more than 200 ETH from its own funds to affected users.
The investigation is still ongoing, the team said, with further tracing focused on the deployer, the source of funds, the test wallets, the batcher infrastructure, and the destination of the drained assets.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
