Chandra Wibowo
In a sophisticated cryptocurrency scam that has defrauded users of approximately $2 million in Ether (ETH), decentralized exchange (DEX) DYORSWAP has reported paying out over 200 ETH in compensation to affected individuals. The illicit operation targeted users by creating a fraudulent bridge that mimicked the upcoming mainnet of GIWA, a layer-2 Ethereum network developed by Dunamu, the operator of South Korea’s largest cryptocurrency exchange, Upbit. The GIWA project has since issued a stern warning, confirming that its mainnet has not yet launched and that any online information suggesting otherwise is false.
The incident, which came to light through DYORSWAP’s detailed reconstruction published on Monday, involved a fake bridge that successfully lured approximately 767.65 ETH from 1,335 distinct wallet addresses. The perpetrators of the scam managed to drain 766.25 ETH from this fraudulent bridge, effectively absconding with the substantial sum. This event highlights a persistent threat within the cryptocurrency ecosystem: the exploitation of anticipation and trust surrounding new blockchain launches and their associated infrastructure.
A Deceptive Launch: The Genesis of the Scam
The core of the scam revolved around the deception of a functional bridge for the GIWA blockchain. Bridges are crucial pieces of infrastructure in the blockchain world, enabling the transfer of digital assets between different networks. For a new or upcoming blockchain like GIWA, a bridge is often one of the first and most anticipated components, as it allows early adopters and developers to interact with the network and its native assets. Scammers capitalized on this anticipation, creating a fake bridge that appeared to be an official gateway to the GIWA ecosystem.
DYORSWAP, a decentralized exchange, stated in its reconstruction that it initially mistook this fraudulent bridge for the genuine mainnet connection. This misunderstanding likely stemmed from the sophisticated nature of the scam, which may have involved elements designed to appear legitimate, such as convincing domain names, user interfaces, or even simulated network activity. The DEX’s involvement suggests that it may have integrated with or relied upon this fake bridge in its operations, inadvertently exposing its users to the risk.
GIWA Project Issues Urgent Warning
In response to the unfolding situation, the GIWA project released a clear and unequivocal statement on Sunday. The official GIWA account on X (formerly Twitter) explicitly stated, "We do not have our mainnet running currently," and cautioned the public against believing any circulating information about mainnet connection details. This direct denial from the project team is critical in preventing further victims from falling prey to the scam.
The timing of the scam is particularly noteworthy. While the exact date of the fraudulent bridge’s operation is not precisely detailed, it occurred during a period of increasing interest and development surrounding the GIWA network. Dunamu has been actively developing GIWA as an Ethereum layer-2 scaling solution. The project launched its Sepolia testnet in September 2025, utilizing Optimism’s OP Stack, a well-established framework for building Ethereum-compatible layer-2 networks. This testnet phase is crucial for developers to build and test applications before the mainnet launch. Furthermore, in April, Dunamu, in collaboration with Hana Financial and POSCO International, announced plans to test a cross-border remittance system based on GIWA Chain, using real trade transactions. These developments would naturally generate significant buzz and attract attention from potential users and investors, creating a fertile ground for malicious actors.
DYORSWAP’s Response and Compensation Efforts
DYORSWAP, upon realizing the nature of the fraudulent bridge, has taken proactive steps to address the situation. The DEX confirmed that its own smart contracts remained uncompromised, indicating that the vulnerability was not within its core infrastructure but rather in its reliance on or interaction with the external, fraudulent bridge. The exchange has initiated a comprehensive investigation to trace the origins of the scam, including identifying the bridge deployer, the funding sources used to establish the fake bridge, suspected test wallets, and the addresses that ultimately received the stolen funds.
Crucially, DYORSWAP has committed to mitigating the financial losses incurred by its users. The DEX announced that it has used its own funds to compensate affected users with over 200 ETH. This act of compensation, while commendable, underscores the significant financial impact of the scam and the responsibility DYORSWAP has taken to protect its community. The total value of the stolen ETH, at the time of the incident, would have been approximately $2 million, based on an estimated ETH price of around $2,600 per coin. This figure could fluctuate significantly depending on the exact price of ETH at the time of the transactions.
Chronology of Events (Inferred and Reported)
While a precise timeline is still emerging, the sequence of events can be pieced together:
- Pre-Scam Development: Dunamu actively develops the GIWA network, launching its Sepolia testnet in September 2025 and announcing partnerships for remittance system testing in April. This period generates anticipation for the mainnet launch.
- Creation of the Fake Bridge: Malicious actors, aware of the impending GIWA mainnet and the need for bridging solutions, create a fraudulent bridge that mimics legitimate GIWA infrastructure.
- Exploitation of DYORSWAP: DYORSWAP, either through integration or user interaction, engages with the fake bridge, inadvertently exposing its users to the scam. Users deposit ETH into the fake bridge, believing it to be an official gateway to GIWA.
- Draining of Funds: The scammers drain approximately 766.25 ETH from the fraudulent bridge, leaving users with losses.
- Discovery and Reporting: DYORSWAP becomes aware of the fraudulent activity and begins its internal investigation.
- GIWA Project Issues Warning (Sunday): The GIWA team publicly states that its mainnet has not launched and warns against false connection details.
- DYORSWAP Publishes Reconstruction (Monday): DYORSWAP details the scam, the amount stolen, and its compensation efforts.
Broader Implications and Analysis
This incident serves as a stark reminder of the evolving landscape of cryptocurrency scams. The sophistication of these operations is increasing, moving beyond simple phishing attempts to more complex schemes that leverage the intricacies of blockchain technology and the anticipation surrounding new projects.
- The Importance of Due Diligence: The scam highlights the critical need for users to exercise extreme caution and perform thorough due diligence before interacting with any new blockchain project or its associated infrastructure. Verifying official announcements, checking project roadmaps, and consulting reputable community channels are essential steps.
- The Role of DEXs and Intermediaries: Decentralized exchanges and other platforms that integrate with various blockchain protocols have a significant responsibility to vet the integrity of the external services they rely upon. While DYORSWAP has demonstrated accountability through compensation, this incident could prompt stricter verification processes for integrated bridges and protocols.
- The Evolving Threat of Synthetic Assets and Fake Infrastructure: The creation of a fake bridge for an unlaunched mainnet demonstrates a new level of deception. Scammers are not just impersonating existing entities but are creating entirely fabricated infrastructure to exploit user trust.
- Regulatory and Security Challenges: The decentralized nature of blockchain makes tracing and recovering stolen funds a complex challenge. This event underscores the ongoing need for enhanced security measures within the crypto space and potentially stronger collaborative efforts between projects, exchanges, and law enforcement to combat such sophisticated scams.
- Impact on GIWA’s Reputation: While the GIWA project itself was not directly responsible for the scam, the incident could cast a shadow over its upcoming launch. The association with a major scam, even indirectly, might lead to increased scrutiny and a need for enhanced communication from the GIWA team to rebuild trust.
The compensation provided by DYORSWAP, while a positive step for its affected users, does not erase the financial losses or the underlying security concerns. The incident is likely to prompt a broader discussion within the crypto community about how to better protect users from such elaborate scams, particularly those targeting nascent blockchain ecosystems. As the GIWA mainnet eventually launches, its team will undoubtedly need to address security concerns and reassure potential users and developers of the network’s integrity and safety. The ongoing investigation by DYORSWAP into the scam’s origins will be crucial in understanding the perpetrators’ methods and potentially bringing them to justice, though the decentralized nature of cryptocurrency often makes such pursuits arduous.
