Scammers built a counterfeit version of Upbit -backed GIWA blockchain and lured 1,333 wallets into depositing 767 ETH, worth about $2 million, before draining almost all of it.

The fake network appeared to be GIWA’s anticipated Ethereum Layer 2 mainnet, complete with an RPC endpoint, cross-chain bridge, and Chain ID 9134, the identifier associated with the planned launch.

In an X post, GIWA said claims that its production RPC had leaked were false because no mainnet RPC exists. Its documentation lists only GIWA Sepolia, which uses Chain ID 91342, while the production network remains under development.

DYORSWAP, whose community initially interacted with the purported network, later said the chain was fraudulent and warned users against unofficial RPC endpoints, bridges and contracts. It stated:

“The fake network used the correct GIWA Chain ID (9134), which made it appear legitimate during our initial verification. We have also identified specific suspicious messages and individuals in the related community that may be connected to this incident.”

Dunamu, operator of South Korea’s largest crypto exchange, Upbit, is developing GIWA using Optimism’s OP Stack.

Dunamu and the Optimism Foundation announced in May that GIWA is planned as the first Self-Managed OP Enterprise chain, allowing Upbit to retain operational control while Optimism provides backup infrastructure and support.

On-chain data suggests the attackers spent hours preparing the infrastructure before the first significant deposits arrived.