Attackers created a fake L2 network under the name GIWA, utilizing the real Chain ID 9134 to deceive users. The fraudulent infrastructure, built on the OP Stack, included a malicious bridge that successfully collected deposits from 1,335 unique addresses. In total, the scammers managed to steal approximately 767.65 ETH, which was valued at around $2 million at the time of the incident.
The developers of the actual GIWA project, backed by Donamu, clarified that their mainnet has not yet been launched. They are currently gathering evidence, including RPC data and transaction logs, to track the attackers. The project team has announced plans to compensate affected users from its treasury, while the decentralized exchange DYORSWAP has already distributed over 200 ETH to impacted traders.
The investigation into the incident is ongoing, with teams working to identify the bridge deployer and trace the movement of the stolen funds. DYORSWAP noted that the attack was not a smart contract exploit but rather a deception involving a fake L2 infrastructure that the exchange initially mistook for a legitimate project due to the use of an active Chain ID.
