South Korea's FSS warns of fake GIWA chain scam after 766 ETH drained

South Korea's Financial Supervisory Service (FSS) issued a consumer alert at the "caution" level (No. 2026-27) on Oct. 22 over a fake blockchain impersonating GIWA, a network under development by Upbit operator Dunamu. According to a tally by decentralized exchange DYORSWAP, which had supported the fake chain, about 767 ETH flowed into the fake network's bridge, a tool that moves assets between blockchains, on Sept. 27, and roughly 766 ETH of that was withdrawn in one go. The FSS said any bridge or smart contract claiming to support a network that has not officially launched is "100% a scam."

Scammers used GIWA's mainnet chain ID before launch

According to the FSS, the scammers spread false claims such as a "surprise mainnet launch" on community channels and social media, then set up an RPC address (the endpoint a wallet uses to connect to a blockchain), a chain ID and a bridge designed to resemble the official network. A chain ID is a unique number a wallet uses to identify which blockchain it is connected to. The FSS release lists the chain ID of GIWA's official network as 91342 and that of the fake network as 9134, adding that the official network has not yet launched.

The public chain ID registry (chainlist) lists 91342 as the "GIWA Sepolia Testnet" and 9134 as the number for GIWA's mainnet, which is still in preparation. DYORSWAP said the fake network used "the correct GIWA Chain ID (9134)," which made it appear legitimate during its initial verification. DYORSWAP supported the fake chain believing it was GIWA's mainnet, and users sent ETH through the fake network's bridge. The FSS said the scammers withdrew the ETH collected in the bridge all at once.

13 hours from bridge deployment to drain

The times given by DYORSWAP and GIWA (KST) are as follows.

1. Sept. 27, 3:10 a.m.The fake bridge was deployed on Ethereum mainnet. The deployer wallet had received 0.045 ETH about 8.5 hours earlier
2. Sept. 27, 3:18 a.m.Three wallets deposited a combined 0.4 ETH in the same second. DYORSWAP judged them to be test wallets the scammers had prepared in advance
3. Sept. 27, 4:18 p.m.GIWA's official X account said "We DO NOT have our mainnet running currently" and that posts claiming to have mainnet connection details were not true
4. Sept. 27, 4:29 p.m.About 766.25 ETH was drained from the bridge
5. Sept. 27, 5:06 p.m.DYORSWAP announced that the chain it had identified as GIWA's mainnet was fake
6. Oct. 22The FSS issued its "caution" consumer alert

By DYORSWAP's count, 1,335 addresses sent funds into the bridge, totaling about 767.65 ETH. The fake chain was not merely a fake webpage but a working network that posted transaction batches to Ethereum, and tokens were bought, sold and launched on it. DYORSWAP said it used those records to reconstruct 298 of its users' wallets and 1,479 actions. At the Upbit Korean won market price around midday on Oct. 22 (3,252,000 won per ETH), the 766.25 ETH drained was worth about 2.49 billion won.

DYORSWAP has already paid out more than 200 ETH

"This was not a DYOR contract exploit," DYORSWAP said, adding that it was also a victim of the fraudulent network. Even so, it said it had paid more than 200 ETH to affected users from its own funds and was continuing to trace the bridge deployer, funding sources and the movement of the drained funds. According to its investigation, two of the apparent test wallets had been funded about 25 days before the incident, one from Binance and one from Gate, and had then sat idle.

The FSS noted that in on-chain scams, funds move within minutes to hours, making losses extremely difficult to recover. It said decentralized exchanges in particular have no central operator controlling assets or trades, so assets sent to scammers are effectively unrecoverable. The FSS plans to have crypto asset service providers developing new blockchains notify users of their development progress and related precautions.

If you see a "surprise launch" announcement