{"id":13804,"date":"2026-09-28T09:44:39","date_gmt":"2026-09-28T09:44:39","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13804"},"modified":"2026-09-28T09:44:39","modified_gmt":"2026-09-28T09:44:39","slug":"crypto-scammers-built-an-entire-fake-blockchain-to-steal-over-2-million","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13804","title":{"rendered":"Crypto scammers built an entire fake blockchain to steal over $2 million"},"content":{"rendered":"

<\/p>\n

\n

Scammers built a counterfeit version of Upbit-backed GIWA blockchain and lured 1,333 wallets into depositing 767 ETH, worth about $2 million, before draining almost all of it.<\/p>\n

The fake network appeared to be GIWA\u2019s anticipated Ethereum Layer 2 mainnet, complete with an RPC endpoint, cross-chain bridge, and Chain ID 9134, the identifier associated with the planned launch.<\/p>\n

But GIWA\u2019s mainnet was not live.<\/p>\n

In an X post, GIWA said claims that its production RPC had leaked were false because no mainnet RPC exists. Its documentation lists only GIWA Sepolia, which uses Chain ID 91342, while the production network remains under development.<\/p>\n

DYORSWAP, whose community initially interacted with the purported network, later said the chain was fraudulent and warned users against unofficial RPC endpoints, bridges and contracts. It stated:<\/p>\n

\n

\u201cThe fake network used the correct GIWA Chain ID (9134), which made it appear legitimate during our initial verification. We have also identified specific suspicious messages and individuals in the related community that may be connected to this incident.\u201d<\/p>\n<\/blockquote>\n

Dunamu, operator of South Korea\u2019s largest crypto exchange, Upbit, is developing GIWA using Optimism\u2019s OP Stack.<\/p>\n

Dunamu and the Optimism Foundation announced in May that GIWA is planned as the first Self-Managed OP Enterprise chain, allowing Upbit to retain operational control while Optimism provides backup infrastructure and support.<\/p>\n

Attackers waited for deposits before changing the bridge<\/h2>\n

On-chain data suggests the attackers spent hours preparing the infrastructure before the first significant deposits arrived.<\/p>\n

Pseudonymous blockchain analyst Stablemark said wallets tied to the operation were funded through ChangeHero on Sept. 26. About 11 hours later, the Safe wallet controlling the scheme and the fake bridge went live.<\/p>\n

Over the next 13 hours, 1,333 wallets deposited a combined 767 ETH.<\/p>\n