DYORSWAP: Over 200 ETH Compensated to Users Affected by 'Fake GIWA Mainnet' Incident, Investigation Ongoing

BlockBeats news, September 28: Multi-chain DEX DYORSWAP has issued an "Official Statement Regarding the Fake GIWA Mainnet 9134 Incident," clarifying that this was not an attack on the DYORSWAP contract, but rather that the project and users were affected by a fake network impersonating the GIWA Mainnet 9134. This network was equipped with a bridge and batcher similar to OP Stack and was deployed on September 27, 2026, at 02:10:59 (UTC+8). Approximately 8.5 hours before deployment, the address received about 0.045 ETH from a ChangeHero-related address.

Just 39 blocks after the bridge went live, three deposits totaling 0.4 ETH entered within the same second, two of which were the first outbound transfers from their wallets. DYOR believes these addresses highly match the characteristics of internal test wallets. The fake L2 then began operating normally and published transaction batches to the Ethereum mainnet. Data shows that a total of 1,335 addresses transferred approximately 767.65 ETH into the bridge, and ultimately about 766.25 ETH was drained. The draining transaction occurred at Ethereum block 26067309.

The DYOR team stated that it has used its own funds to distribute over 200 ETH to affected users and said the investigation is ongoing, and it will track down the deployer, funding sources, test wallets, batcher infrastructure, and the destination of the drained funds.