The fake GIWA chain: 766 ETH bridged into a lookalike

01 · The rumourA mainnet that was not live

At 03:00 UTC on September 27, 2026, ETH began pouring into a contract on Ethereum that was nine hours old. People believed it was the bridge to GIWA mainnet. They believed the mainnet's RPC address had leaked early, and that being first onto a new chain would pay.

GIWA is real. It is an L2, a chain that runs on top of Ethereum, tied to Upbit, and it has been running a testnet. What it did not have that morning was a mainnet. The network people were joining was a copy that someone else had built.

The copy answered with GIWA's chain ID, 9134. A chain ID is a number a wallet uses to tell networks apart. Anyone can set one, so it proves nothing about who runs the network. Wallets showed the right number, and transactions went through.

We cannot see inside the copy. It was a private network, and no public index holds it. But the bridge lived on Ethereum, where every transfer is on the record. Bitquery indexes all of them, so we pulled each deposit, the drain, and every step the money has taken since.

02 · The setupBuilt in a day

Two fresh wallets did the work. Both got their first ETH on the morning of September 26, two hours apart, from the same source. Our labels mark that source as a hot wallet of ChangeHero, a service that swaps one coin for another. Some posts on X named a different swap service. Either way, the wallets were paid through a swap and had no history of their own.

That evening the first wallet deployed the bridge and its supporting contracts in under four minutes. Seven minutes later the second wallet started sending data to Ethereum.

This is the part that made the copy hard to tell from the real thing. A rollup proves it exists by posting its transaction data to Ethereum in batches. The second wallet did exactly that. It posted a batch about every four minutes, all night, to one fixed address. Each one used Ethereum's blob format, the cheap data space that L2s use.

Nothing here needed a new trick. The software to run an L2 is open source, and a bridge contract is a standard part of it. What the builders added was a name that people were waiting for.

03 · The rushThirteen hours, 1,333 addresses

For the first eight hours almost nothing came in. Then the rumour caught.

Three hours held most of it. In that stretch the bridge took in close to nine-tenths of all it would ever hold. Those are midday and afternoon hours in East Asia, where GIWA's following is strongest.

Most people sent small sums. The median address, the one in the middle when you line them all up, sent 0.072 ETH, worth less than two hundred dollars. More than half of all addresses sent less than a tenth of an ETH.

The money was far less even than the crowd. Fourteen addresses, about one in a hundred, supplied more than a quarter of the ETH. One address deposited 89 separate times.

04 · The warningWhat happened after GIWA spoke

GIWA's team saw the rumour and answered it. At 06:09 UTC its account on X said the mainnet had not launched, so there was no RPC to leak. By then most of the money was already in.

It did not stop at once. Deposits kept landing for another 80 minutes. GIWA posted again just over an hour later, in stronger words. Nine minutes after that, DYORSWAP, a DEX that had been running on the copy, told users to stop bridging.

The warning worked, slowly. In the hour GIWA spoke, deposits fell to less than a quarter of the hour before. Then they held near that pace until the drain. A public denial takes time to travel, and 125 addresses sent ETH between the post and the drain.

Then there are the last 25 deposits. They arrived after the bridge had been emptied, the final one more than ten hours later. That ETH, 2.7 in all, was still sitting in the contract when we last checked.

05 · The drainOne transaction

Less than three minutes after DYORSWAP's warning, the bridge was emptied.

The deploying wallet had been quiet all night. In the last eight minutes it deployed two new contracts. Twenty-four seconds after the second, it sent the transaction that moved everything. It went through a contract that posts on X describe as a two-key multisig. We did not check its settings.

All 766.25 ETH went to one fresh address. That sum matches, to the last digit we hold, the total of every deposit made before that moment. The second wallet posted one more data batch five minutes later, then stopped for good.

DYORSWAP confirmed the rest at 08:06. It said the network it had taken for GIWA mainnet was a fake chain set up by scammers, and that the matching chain ID had made it look right during its own checks.

06 · The exitInto Tornado Cash, in fixed sizes

The money did not rest. Within 50 minutes it was on its way into Tornado Cash, a mixer that pools deposits of fixed size so that a later withdrawal cannot be matched to the deposit behind it.

The receiving address split the ETH three ways. It kept about 227 and fed that to the mixer itself. It sent 288 to a second wallet and 251 to a third.

Every deposit into the mixer was 100, 10, 1 or 0.1 ETH, the four sizes its ETH pools accept. Our labels mark the receiving contract as Tornado Cash's router. We have looked at how much the mixer handles since the US lifted its sanctions, and this is what that use looks like up close.

The third wallet moves in a different way. It passes ETH down a chain of new wallets, 30 at a time, and each one sends part to the mixer and part onward. It was still doing so on the morning of September 28. Seven minutes before our cut it sent on all it had left, about 161 ETH, to the first wallet in that chain. That path is the one still open to watch.

There is a small, odd footnote. Twelve minutes after the drain, the thief's own wallets began to receive worthless tokens, some of them named ETH, from addresses built to look like theirs, with the same first and last characters. That is address poisoning. Bots run it against any wallet that moves large sums, in the hope that the owner copies the wrong address later. Here the bots were aiming at the person who had just taken the money.

07 · The refundWhat has come back

DYORSWAP said it would pay from its own treasury, and named the address it would pay from. Its terms: addresses that bridged under 5 ETH get 40% back. Larger ones are reviewed one by one, because, in its words, some may be tied to phishing or to the fake bridge itself.

We checked the payments against the list of depositors.

The first thousand payments went out in 38 minutes on the afternoon of September 27, through a contract that pays many addresses in one go. The wallet that ran it had been funded by the address DYORSWAP named.

The terms leave a gap. Forty percent of what the smaller addresses bridged is about 169 ETH, and most of that has now gone out. The rest of the money paid so far went to 20 of the 34 larger addresses. Those 34 bridged 346 ETH between them, and most of their refunds are not settled. None of the money returned so far came from the thief.

08 · The hypeThe name was already selling

The copy worked because people wanted GIWA before it existed. That demand shows up in DEX trading on other chains.

In the 30 days to September 28 we found 133 tokens named after GIWA trading on chains that are not GIWA. Most barely traded. We counted the 21 that did at least $10,000 of volume. Eleven were on Robinhood Chain, seven on Solana and three on BNB Chain. The busiest with a real price, on Robinhood Chain, traded about $3.9 million. One BNB Chain token shows far more volume at a price near zero, and we set that figure aside. None has any tie to the GIWA team that we can find.

It is the same pattern we measured when Arc launched: a new chain draws a crowd that wants to be early, and the crowd arrives before the chain does. This time someone built the chain for them.

09 · The recordAddresses and method

Method: our investigation team pulled every ETH transfer into and out of these addresses from Bitquery's Ethereum index, and every transaction the two setup wallets sent. We counted native ETH only and left out failed transfers. Dollar values use our price data for the hour of the drain. Refunds are payments from the address DYORSWAP named, or from the wallet it funded, to addresses that had deposited. Times are UTC. Balances are as of 10:00 UTC on September 28, 2026, and the money is still moving.

What we could not measure is the copy itself. DYORSWAP says it decoded 1,731 transactions from 275 wallets on the fake network. We have no way to check that, and we do not know who built it.