Incident case file

Fake GIWA Bridge — Counterfeit L2 (Chain ID 9134) drains bridged ETH

Incident date Sep 26, 2026Last updated Oct 8, 2026

2 views

RecoveringEthereum L1 (EVM) — counterfeit OP Stack L2Fake chain / bridge scamCluster: GIWA-FAKECHAIN-2026-09

Estimated loss

$2M

Affected users

1335

Group joining is coming soon.

Investigation

75%

Facts and investigation

Ledger

Attacker

Deployer 0x119e68B59C44291F76324c76377B776D0b4Dd38c; fake bridge 0xbA9938C0b96A70E6479661B915e7E481fE435ab2; executing Safe 0xccC2aeCf5d24f0eA30cf81Ec0dBEC59F19DdCD10; receptacle 0x04a9c8D8FEe491411Bda28b68aD80F0122Fc4134 (all Ethereum). Operator unknown.

Funds moved to

766.254042109578965279 ETH arrived on the receptacle 0x04a9c8D8FEe491411Bda28b68aD80F0122Fc4134 on Sep 27 at 07:29:59 UTC. 764.9 ETH (about 99.8%) were then deposited into the Tornado Cash router 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b in 80 deposits between Sep 27 08:19 and Sep 28 11:18 UTC: 227.1 ETH from the receptacle itself, 287.8 ETH from hop wallet 0xEC160acd00D95EbbBE0394161101eb577CA96b60, 190 ETH from 0xd5af44dd7c5f0e8c95d88713bfabcc351e06a8ee, 30 ETH from 0xCc028B20Bdfcb1bFa5f48bBa

Linked

Hop wallets: 0x8c563fc543f6ecC2C8c09eB09D82798f7a7F3dA4 (received 251 ETH from the receptacle, forwarded 250.999598 ETH to 0xd5af44dd7c5f0e8c95d88713bfabcc351e06a8ee), 0xEC160acd00D95EbbBE0394161101eb577CA96b60 (received 288 ETH), 0xd5af44dd7c5f0e8c95d88713bfabcc351e06a8ee (sent 60.020355 ETH to 0xCc028B20Bdfcb1bFa5f48bBa0f935574Fb2CbA64 and 190 ETH to Tornado Cash), 0xCc028B20Bdfcb1bFa5f48bBa0f935574Fb2CbA64 (30 ETH to Tornado Cash, 30.01 ETH to 0x9cBAD8669bd9964BE71BC99e1725dF1c67949a70). Drain transaction 0x1f3c0a2375a6f043a4f2473f822398587d9af5225e4dc1275ca0eeda67dc7306 (block 26067309). Fake bridge deployed in block 26063331 on Sep 26 at 18:10:59 UTC; the deployer received 0.045 ETH from a ChangeHero-linked address about 8.5 hours earlier (address not retrieved). Heavy address poisoning around every hop wallet (look-alike addresses sending dust and fake tokens): none of those look-alikes is a real destination. DYORSWAP confirmed its own contracts were not compromised and compensated users with more than 200 ETH.

Chronology

1 beat

Sep 26, 2026 at 18:10:59 UTC a fake OP Stack bridge was deployed using the reserved Chain ID 9134, and DYORSWAP listed the counterfeit 'GIWA' network. Between Sep 26 and 27, 1,335 addresses bridged about 767.65 ETH into it. On Sep 27 at 06:09 UTC GIWA warned that its mainnet was not live. At 07:29:59 UTC (block 26067309) the bridge was upgraded and 766.25 ETH were withdrawn in one transaction to the receptacle address. Between 07:41 and 08:07 UTC the receptacle forwarded 251 ETH and 288 ETH to two fresh wallets and started depositing 10 ETH batches into Tornado Cash at 08:19 UTC. Over the next 27 hours five successive wallets deposited 764.9 ETH into Tornado Cash in 80 deposits; the last deposits ran until Sep 28 at 11:18 UTC. On Sep 28 DYORSWAP stated that its contracts were not compromised and paid more than 200 ETH in compensation. No attribution has been published. Look-alike addresses spammed every wallet in the chain with dust and fake-token events (address poisoning).

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)