What happened
Scammers stood up a fake 'GIWA Mainnet' that reused the real GIWA chain ID 9134 (GIWA is the OP Stack layer 2 from Upbit operator Dunamu, which had no live mainnet at the time). DYORSWAP checked the chain ID, treated the network as genuine, and made it available to its users. Between September 26 and 27, 2026, 1,335 addresses sent 767.65 ETH into the fake chain's bridge, and its operators withdrew 766.25 ETH (about $2 million), with funds reported moving to Tornado Cash.
DYORSWAP stated its own contracts were not attacked. It paid more than 200 ETH in compensation from its own funds, including a 40% refund for addresses that bridged under 5 ETH, with larger losses reviewed case by case.
How it happened
- The scammers deployed a fake OP Stack-style chain and bridge that used GIWA's real chain ID
9134, shortly after 18:00 UTC on September 26. - DYORSWAP's verification relied on the matching chain ID, so it treated the network as GIWA Mainnet and exposed it to users; DYORSWAP later linked suspicious community messages to the scam.
- Users bridged real ETH into the fraudulent bridge: 767.65 ETH from 1,335 addresses.
- Because the operators controlled the bridge, they withdrew 766.25 ETH within about 12 hours and routed funds toward Tornado Cash.
Protocol details
Evidence
- report DYORSWAP (@DYORSWAPDEX) Security Incident Notice on X x.com
- analysis DeFiLlama defillama.com
- analysis DYORSWAP users tricked into sending 767 ETH to fake bridge contract protos.com
- analysis DYORSWAP Fake Bridge Scam Drains $2M in ETH en.cryptonomist.ch
- analysis DYORSWAP Clarifies Incident Not a Contract Hack, Compensates Users with Over 200 ETH kucoin.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
