A Fake Blockchain With the Right Chain ID Cost 1,333 Wallets $2 Million

A blockchain that doesn't exist just took $2 million from 1,333 wallets. And it did it with a number anyone could copy.

Scammers stood up a counterfeit version of GIWA, the Ethereum Layer 2 Dunamu is building behind Upbit, South Korea's largest exchange. The fake network came with a live RPC endpoint, a working cross-chain bridge, and Chain ID 9134. That's the exact identifier GIWA's real mainnet is expected to use. GIWA's production RPC isn't live. Its docs list only the Sepolia testnet, Chain ID 91342. One extra digit separated the real thing from the counterfeit.

The preparation is what gets me. Wallets tied to the operation were funded through ChangeHero on Sept. 26. About 11 hours later, the Safe wallet and the fake bridge went live. Then over 13 hours, 1,333 wallets deposited 767 ETH, roughly $2 million. The operators swapped the bridge's portal code and drained 766 ETH in one transaction.

So they didn't hustle anyone. They built a storefront, stocked it, and waited. That's patient work.

DYORSWAP, whose community touched the fake chain first, is paying 40% compensation to wallets that bridged under 5 ETH. Forty percent. Wallets above that threshold get individual review and possible flagging as phishing-linked. So most victims eat the loss either way. Of the stolen funds, 177 ETH already moved through Tornado Cash. Another 589 ETH sits across four wallets, still visible and still traceable for now.

Here's my problem with the standard response. Everyone will say these people should've done more research. That's the consensus trade and it's crowded. Wrong target. A Chain ID doesn't verify who controls the RPC or the bridge behind it. It's a label, not a lock. Every wallet in crypto trusts that number to tell it which network it's talking to, and anyone with a server can print a matching one. The exploit isn't user ignorance. It's that the identification layer for EVM networks was never built to be trusted, and we all agreed to pretend otherwise.

Watch the 589 ETH. Once that moves, the recovery window shuts, and GIWA's launch inherits a security story Dunamu never wanted.