{"id":78765,"date":"2026-09-28T06:12:09","date_gmt":"2026-09-28T06:12:09","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/scammers-launch-fake-eth-l2-to-steal-2m-from-crypto-traders\/"},"modified":"2026-09-28T06:12:09","modified_gmt":"2026-09-28T06:12:09","slug":"scammers-launch-fake-eth-l2-to-steal-2m-from-crypto-traders","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/scammers-launch-fake-eth-l2-to-steal-2m-from-crypto-traders\/","title":{"rendered":"Scammers Launch Fake ETH L2 to Steal $2M From Crypto Traders"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">A fake GIWA Ethereum L2 chain drained 766 ETH (over $2M) from 1,335 users who bridged funds.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Scammers deployed a complex fake chain with functioning bridges, initially deceiving DYORSWAP.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">DYORSWAP is investigating the scam and refunding users, but faces backlash for enabling it.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Fake Giwa L2 Chain Deployment Scheme Causes Over 760 ETH in Losses<\/h2>\n<p>A new sophisticated scheme involving the launch of a fake <a href=\"https:\/\/news.bitcoin.com\/what-are-rollups-ethereums-main-scaling-solution-examined\/\">Ethereum L2 solution<\/a> has been reported for the first time, affecting over a thousand users who bridged their funds to the chain.<\/p>\n<p>The chain, which used 9134 as its Chain ID number, was identified by DYORSWAP, a multi-chain decentralized exchange (DEX), as the mainnet for GIWA, an Upbit-backed project at first, taking early adopters to quickly bridge funds to the chain to take advantage of the financial opportunities next.<\/p>\n<p>Initially, some claimed the scam only involved taking a normal ETH address and posting it as an L2 chain. Nonetheless, <a href=\"https:\/\/x.com\/DYORSWAPDEX\/status\/2104269975745945742?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">in its official report<\/a>, DYORSWAP stressed this was not the case, as the chain deployment included an OP stack-style infrastructure, a bridge, and a batcher, indicating a larger degree of sophistication.<\/p>\n<p>The theft was executed after over 1,335 addresses bridged funds to the contract, with approximately 766.25 ETH drained from these users, valued at over $2 million at the time of writing.<\/p>\n<p>Before the funds were drained, DYORSWAP identified real movement in the impersonating chain, with user transactions including buys, sells, and token launches happening in real time.<\/p>\n<p><strong>\u201cUntil further notice, DO NOT use any unofficial GIWA Mainnet RPC, bridge, or contract, and DO NOT send funds to any related addresses,\u201d<\/strong> DYORSWAP declared after detecting that user funds were drained.<\/p>\n<p>Nonetheless, as the incident happened, the real Giwa project clarified that it had not stealth-launched its mainnet. \u201cWe DO NOT have our mainnet running currently. <strong>Any of those posts claiming that they have GIWA mainnet RPC information are NOT TRUE,\u201d<\/strong> <a href=\"https:\/\/x.com\/GIWA_by_Upbit\/status\/2104108336228843590?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Giwa explained on social media.<\/a><\/p>\n<p>While it denied direct responsibility in the attack, saying the funds were drained from the fake chain, DYORSWAP started a reimbursement process for affected users, claiming it had already distributed over 200 ETH from its own funds.<\/p>\n<p>DYORSWAP stressed that it will continue to investigate and reconstruct the whole fake chain transaction history to identify and trace the attacker\u2019s addresses.<\/p>\n<p>Even so, users criticized DYORSWAP\u2019s approach, arguing that without their involvement, none would have noticed the chain launch or bridged funds onto it, labeling it a social engineering scam.<\/p>\n<p>The fake Giwa mainnet launch scheme follows <a href=\"https:\/\/news.bitcoin.com\/gofrom\/most_popular\/zano-wipes-1-month-of-history-to-fix-massive-crypto-inflation-bug\/\">a series of security incidents<\/a> targeting both decentralized and centralized platforms, which are keeping crypto holders on constant alert.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/scammers-launch-fake-eth-l2-to-steal-2m-from-crypto-traders\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways A fake GIWA Ethereum L2 chain drained 766 ETH (over $2M) from 1,335 users who bridged funds. Scammers deployed a complex fake chain with functioning bridges, initially deceiving DYORSWAP. DYORSWAP is investigating the scam and refunding users, but faces backlash for enabling it. Fake Giwa L2 [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":78766,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78765"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78765"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78765\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78766"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}