Scammers deployed a counterfeit OP Stack-style network impersonating GIWA, including an RPC endpoint, Ethereum bridge and batch-posting infrastructure. The fake network reported GIWA’s expected mainnet Chain ID 9134, causing DYORSWAP and users to mistake it for the legitimate GIWA mainnet. Users voluntarily deposited ETH into the fraudulent bridge. After accumulating deposits, the scammers drained 766.25 ETH to an attacker-controlled address. GIWA’s actual mainnet had not launched, and neither GIWA nor DYORSWAP’s smart contracts were exploited

Scammers deployed a fake GIWA L2 network using the legitimate Chain ID 9134, complete with a functional bridge and batcher. Approximately 1,335 addresses bridged ~767.65 ETH believing it was the official mainnet launch. The attackers drained ~766.25 ETH (~$2M). The real GIWA mainnet had not launched. DYORSWAP initially listed the fake network due to the matching Chain ID and later compensated affected users from its treasury.