DYORSWAP, a multi-chain decentralized exchange, said scammers tricked it into integrating a fake version of the upcoming GIWA blockchain over the weekend, leading users to send funds to a spoofed bridge contract. The incident resulted in roughly $2 million in losses, with DYORSWAP later saying 1,335 addresses bridged a total of 767.65 ETH and that almost all of it was drained. According to the exchange, the fake OP Stack chain used the same chain ID as the legitimate GIWA network, 9134, which made it appear valid during DYORSWAP’s initial verification. DYORSWAP also pointed to suspicious messages that may have spread false information inside its community. The bridge contract was deployed shortly after 6 PM UTC on Saturday and emptied a little more than 12 hours later, with proceeds later moved into Tornado Cash. GIWA’s official X account denied that its mainnet existed, but the denial came only minutes before the fake bridge was drained. DYORSWAP said users who bridged less than 5 ETH would receive a 40% refund, while larger cases would be reviewed individually. In a later update, it said it had already distributed more than 200 ETH in compensation and identified addresses it believes were involved in the scam, allegedly funded from Binance and Gate.

A fake Layer 2 network posing as GIWA, which The Defiant described as being backed by Upbit, had 766.25 ETH drained from its Ethereum bridge on Sept. 27, with the amount valued at roughly $2 million in the report. According to The Defiant, the loss happened after decentralized exchange DYORSWAP mistook the fake network for the legitimate GIWA chain. Ethereum transaction data cited in the report shows the transfer moving out from the bridge address 0xbA9938…435ab2. The summary available in the source does not provide additional operational details beyond the transfer, the date, the amount, and the address reference.

A fake blockchain posing as GIWA’s mainnet siphoned roughly $2 million in Ether from users through a bridge that decentralized exchange DYORSWAP initially treated as legitimate. In a reconstruction released Monday, DYORSWAP said the fraudulent bridge took in about 767.65 ETH from 1,335 addresses, with 766.25 ETH later drained by the scammers. GIWA, an Ethereum layer-2 network built by Upbit operator Dunamu, said on Sunday that its mainnet had not launched and that connection details circulating online were false. The project stated plainly that it does not currently have a mainnet running. DYORSWAP said its own contracts were not compromised and that it is tracing the bridge deployer, funding sources, suspected test wallets and recipient addresses. The exchange also said it used its own funds to compensate affected users with more than 200 ETH. Dunamu launched GIWA’s Sepolia testnet in September 2025 on Optimism’s OP Stack, and in April it agreed with Hana Financial and POSCO International to test a GIWA Chain-based cross-border remittance system using real trade transactions.

A dense batch of crypto and AI headlines landed between Sept. 27 and Sept. 28. Hyperliquid said its next network upgrade will raise HIP-4 deployment capacity while cutting the cap on perpetual funding rates from 4% per hour to 0.5% per hour. Ethereum co-founder Vitalik Buterin wrote that Hegota, planned for next year, could be Ethereum’s last “regular” upgrade as the network shifts toward what he called a “cryptographic world computer,” with future work centered on recursive STARKs, formal verification, optimized proof-of-stake, and quantum safety. Elsewhere, NYSE Arca approved the listing of Bitwise’s spot NEAR Protocol ETF under the ticker NRR, the first spot NEAR ETF in the U.S. Token Unlocks data showed a heavy unlock calendar next week led by DoubleZero, Sui, Ethena, Kamino, CARDS, EIGEN, and FF. On-chain activity also drew attention: one Solana whale’s 20x leveraged long was sitting on more than $23 million in unrealized profit, while analyst Wazz said a Robinhood-chain group had cashed out about $18.43 million across at least 53 token launches over the past two months. Additional updates covered Quant’s rally after a partnership announcement involving The Clearing House, stablecoin holder growth, DYORSWAP’s statement on the GIWA Chain 9134 incident, and several AI-related developments tied to Anthropic, MiniMax, and the White House.

Multichain DEX DYORSWAP said in an on-chain review statement that the fake network involved in the incident was deployed at 2:10:59 on Sept. 27. According to the team, the network operated in the form of a functioning Layer 2 and submitted transaction batches to Ethereum. Reconstructed data showed that about 1,335 addresses deposited roughly 767.65 ETH into the fake cross-chain bridge, and about 766.25 ETH was ultimately moved out. DYORSWAP said it has already distributed more than 200 ETH to affected users. The team added that it will continue tracing the deployer, the source of funds, and the recipient addresses tied to the incident.

DYORSWAP, a multi-chain decentralized exchange, said the losses tied to the so-called fake GIWA Mainnet 9134 incident did not stem from an attack on its own contracts. In a statement released on Sept. 28, the team said both the project and its users were affected by a fraudulent network impersonating GIWA Mainnet 9134. According to DYORSWAP, the fake network deployed an OP Stack-like bridge and batcher on Sept. 27, 2026, at 02:10:59 UTC+8. Roughly 8.5 hours before deployment, the address involved received about 0.045 ETH from an address linked to ChangeHero. The bridge then saw three deposits totaling 0.4 ETH in the same second after just 39 blocks, with two of them being the first outgoing transfers from those wallets. DYOR said the pattern strongly matched internal test-wallet characteristics. On-chain data cited by the team showed that 1,335 addresses sent about 767.65 ETH into the bridge, and about 766.25 ETH was ultimately drained. The outflow transaction took place in Ethereum block 26067309. DYORSWAP said it has already paid more than 200 ETH from its own funds to affected users and that its investigation remains ongoing.

DYORSWAP said in an official statement that the so-called GIWA mainnet 9134 incident was not caused by a vulnerability in the DYOR contract. Instead, the team said the losses were tied to a fraudulent network impersonating GIWA Chain 9134. According to the statement, the network had a bridge and batcher resembling OP Stack infrastructure and was deployed at 02:10:59 on Sept. 27, 2026, UTC+8. Roughly 8.5 hours before deployment, the address received about 0.045 ETH from an address linked to ChangeHero. On-chain data cited by DYORSWAP shows that 1,335 addresses bridged in about 767.65 ETH in total, and around 766.25 ETH was ultimately transferred out through the cross-chain bridge. DYORSWAP also said it has already used its own funds to compensate affected users with more than 200 ETH. The team added that it is still tracing the bridge deployer, the source of funds, early test wallets, and the later movement of the transferred assets.

DYORSWAP said on Sept. 27 that it has finished reviewing all affected addresses tied to the incident and has set a uniform compensation rate for smaller bridge transfers. According to the update, any affected address that bridged less than 5 ETH will receive compensation equal to 40% of the bridged amount, regardless of whether the funds were later used for trading. Addresses that bridged more than 5 ETH will not be processed under the same blanket rule. DYORSWAP said some of those larger transfers may be linked to phishing activity or fraudulent bridging behavior, so they will be reviewed separately. Users who bridged more than 5 ETH and believe they are legitimate affected users can contact DYORSWAP for identity and address verification. The project also disclosed the compensation distribution address, 0xdf25f88aa6cde9937fdcfcf10fa349528c79dbf9, and told users to verify it carefully. DYORSWAP added that it will not ask users to transfer funds, sign suspicious transactions, or pay any fee to receive compensation.