Fake GIWA bridge incident, 2026-09-27
What happened to Fake GIWA bridge?
On 26–27 September 2026 scammers stood up a fake “GIWA mainnet” — impersonating the unlaunched layer 2 of Upbit operator Dunamu — with its own RPC and bridge. About 1,331 wallets bridged 767 ETH in; at 07:29 UTC on 27 September the bridge's owners withdrew 766.25 ETH (≈ $2M), which then went to Tornado Cash.
Key facts
- Date (UTC)
- Protocol
- A counterfeit “GIWA mainnet” and OP Stack-style bridge impersonating GIWA, the not-yet-launched layer 2 of Upbit operator Dunamu
- Reported loss
- 766.25 ETH (≈ $2M) deposited by ≈ 1,331–1,335 wallets; DefiLlama lists $2.08M PublicAMLCointelegraphCryptoSlateDefiLlama
- Root cause
- Impersonation / phishing — a fake L2 with the expected chain ID and a bridge proxy controlled by a 2-of-2 Safe; the owners swapped the portal code and emptied deposits PublicAMLCryptoSlate
- Chains
- Ethereum, fake GIWA chain (ID 9134)
- Recovery
- Partly recovered
- Official post-mortem
- 待核实
Timeline
All dates and times in UTC.
- 2026-09-26 — Wallets tied to the operation funded via ChangeHero; about 11 hours later the controlling Safe and fake bridge go live. CryptoSlate
- 2026-09-26 18:07 — First Safe owner deploys the bridge proxy and the 2-of-2 Safe (18:07–18:10). PublicAML
- 2026-09-26 → 27 — Over ≈ 13 hours, 1,331 wallets send 2,136 deposits into the fake bridge; DYORSWAP lists the network. PublicAML
- 2026-09-27 07:29 — Bridge owners withdraw 766.25 ETH in a single transaction. PublicAML
- 2026-09-27 — GIWA states that its mainnet is not running. Cointelegraph
- 2026-09-28 — Funds fully in Tornado Cash (PublicAML); DYORSWAP publishes a reconstruction and pays > 200 ETH compensation. Cointelegraph
Where did the funds go, and was anything recovered?
The bridge owners withdrew 766.25 ETH in one transaction at 07:29 UTC on 27 September; by the morning of 28 September PublicAML traced all of it into Tornado Cash through five branches (PublicAML). An earlier snapshot by analyst Stablemark, reported by CryptoSlate, had 177 ETH in Tornado Cash and 589 ETH still in four wallets (CryptoSlate).
The DEX DYORSWAP, which had listed the fake network, said it paid more than 200 ETH in compensation to affected users (Cointelegraph). We found no report of stolen ETH being recovered.
Which routes and bridges were affected?
Only people who bridged ETH from Ethereum into the fake “GIWA mainnet” lost money. GIWA itself said its mainnet was not running and that circulating "leaked RPC" details were false (CryptoSlate). No genuine OP Stack bridge was compromised; the fake portal merely pointed at real OptimismPortal code so it looked standard on a block explorer (PublicAML).
Our reviews of the bridges involved: OP Stack Standard Bridge
Why did it happen?
Nothing was hacked here in the usual sense: the contracts did exactly what their owners allowed. The bridge was a proxy whose implementation could be changed by a 2-of-2 Safe; it initially pointed at the real OptimismPortal code, so a quick look on a block explorer showed a standard OP Stack bridge (PublicAML). The network used the chain ID people expected for GIWA mainnet (9134), which is what convinced DYORSWAP during its initial check (CryptoSlate).
The real signal was off-chain: GIWA had not announced a mainnet, and its documentation listed only the Sepolia testnet. For an official rollup bridge, the portal contract is owned by the rollup's published governance (for OP Stack chains, the chain's ProxyAdmin and its documented owners) and the addresses appear in the project's own docs and in L2Beat. A bridge controlled by two unknown addresses that had been deployed hours earlier fails every one of those checks.
The case shows that "verified contract code" is not the same as "safe bridge". Upgradeable proxies inherit the trust of whoever can upgrade them, so the admin, not the code, is the security model.
How this compares with a real rollup bridge: a canonical OP Stack bridge cannot be upgraded by two anonymous keys, and its withdrawals pass through a published challenge period. Neither safeguard existed here, so the owners could empty the vault in one transaction.
What should users have done then, and what should they do now?
At the time
Before bridging into a "new mainnet", users needed to confirm it on the project's official site and X account, and to look up the bridge address in the official docs or on L2Beat. Being early to an unannounced network is exactly the incentive these scams exploit; waiting a day for the official announcement would have avoided the loss.
Now
For any rollup's native bridge, use the link from the project's own docs (our reviews list verified official links), check that the chain appears on L2Beat, and treat leaked RPCs or "early access" bridges as scams by default. Never add a network to your wallet from a link in a chat group.
What is still unverified?
- 待核实 Depositor count differs slightly: 1,331 (PublicAML), 1,333 (CryptoSlate), 1,335 addresses (DYORSWAP via Cointelegraph).
Sources
4 independent publishers. Links checked on the date shown.
- Fake GIWA bridge: 1,331 wallets paid in, and all 766 ETH went to Tornado Cash — PublicAML · Analytics · checked
- Scammers steal $2M in ETH as fake GIWA network fools DYORSWAP — Cointelegraph · Media · checked
- Crypto scammers built an entire fake blockchain to steal over $2 million — CryptoSlate · Media · checked
- DefiLlama Hacks — fake GIWA bridge, 2026-09 — DefiLlama · Database · checked
How do I cite this page?
Burn, A. / upswap.io (2026). Fake GIWA bridge incident (2026-09-27). Updated 2026-10-24. https://upswap.io/incidents/fake-giwa-bridge-2026#summary. CC BY 4.0. Accessed ____.
Stable anchors: #summary #facts #timeline #funds #affected #analysis #then #now #sources #cite