The Chain That Never Existed: Forensic Autopsy of a Fake GIWA Layer 2 and the 766 ETH That Left in One Transaction

The bridge worked for twelve hours. That was the tell.

On September 26, a network advertising itself as chain ID 9134 accepted deposits from 1,333 distinct wallets. It returned receipts. It confirmed balances. It let users approve tokens, watch their explorer update, and feel the specific satisfaction of being early. And for twelve of the thirteen hours it existed, every single check a user could reasonably perform came back clean.

Then, in one transaction, 766 of the 767 ETH that had flowed in were moved out. Not drained gradually. Not exploited through a reentrancy loop. Moved — by the operator, through an entry function that had been rewritten moments before.

The total captured was roughly $2 million. The capture rate was 99.87%. The entire economic life of the scam was thirteen hours.

Here is what makes this case worth more than a news cycle: there was no vulnerability exploited in the traditional sense. There was no oracle manipulation, no flash loan, no private key leak. The attackers did not break anything. They built something, let it run, and then turned it off. That distinction matters enormously, and almost every headline I have read about this event gets it wrong.

Context: What GIWA Is, and What It Is Not

To understand the crime you have to understand the vacuum it was committed in.

GIWA is a Layer 2 network being built by Dunamu, the parent company of Upbit — the largest South Korean exchange by volume. The chain is constructed on the OP Stack, the same modular rollup framework that underlies Optimism and Base. Optimism Foundation has been publicly identified as providing backup infrastructure and support.

That provenance matters. In the Korean market, an L2 backed by Upbit is not a curiosity. It is a gravity well. Upbit's user base is deep, retail-heavy, and structurally conditioned to farm airdrop expectations. Every exchange-adjacent chain launched in the past three years has trained a specific behavior pattern into that user base: get in before mainnet, get in before the token, get in before the snapshot.

But GIWA's mainnet had not launched. As of the incident window, only a Sepolia testnet had been published — testnet chain ID 91342. The planned mainnet chain ID, 9134, existed as a piece of pre-release information circulating in community channels and documentation, not as a live, verifiable network.

That single digit of difference — 9134 versus 91342 — is where the entire operation lived.

The attackers built a private, EVM-compatible network. They deployed a bridge contract to it. They distributed an RPC endpoint. They advertised chain ID 9134. And they did all of this before the legitimate operator had shipped the real thing.

One more entity belongs in the frame. DYORSWAP, an early DeFi project positioning itself inside the anticipated GIWA ecosystem, interacted with the fake network first, warned its community, and then committed to a partial compensation plan for affected users. That last item — the compensation plan — deserves its own forensic treatment further down, because the arithmetic is less generous than the announcement implies.

Core: Tracing the Ghost in the Smart Contract Code

Part I — EIP-155 Does Not Authenticate Anyone

Start with the structural blind spot, because it is not a GIWA bug and it is not going away.

EIP-155 introduced the chain ID to prevent replay attacks across networks. Its purpose is narrow and its purpose was achieved: a transaction signed for one chain cannot be replayed on another. This is a cryptographic guarantee about transaction validity.

It is not an identity system. It never was.

Chain ID tells your wallet which network to talk to. It says nothing about who controls that network, who operates the RPC endpoint answering your queries, or who holds the admin keys to the bridge contract you are about to approve. A chain ID is a label, not a signature. The industry taught users to verify the label and forgot to teach them that the label is unsigned.

An RPC endpoint is a middleman. When you ask it for your balance, it answers. When you ask it to broadcast a transaction, it broadcasts. When you ask it whether chain ID 9134 is the network you think it is, it tells you yes — because you asked the thing you are trying to verify.

This is the circular trust problem at the center of every RPC-based wallet interaction, and in the pre-mainnet window it becomes fatal. There is no canonical, signed, authoritative source for a network that has not launched. There is only documentation, community chatter, and whatever endpoint someone hands you.

The attackers did not guess chain ID 9134. They used it. That number was already public, already circulating, already legitimized by repetition in community channels. The pre-release information that was supposed to build anticipation built the disguise instead.

Part II — The Entry Code That Pivoted in a Single Block

Here is where the operational sophistication becomes visible, and where the "smart contract exploit" framing collapses entirely.

A malicious bridge has a problem. If it simply steals deposits on arrival, users notice in minutes and the funnel closes. The window is short and the yield is low. So the attackers ran a two-phase operation.

Phase one: operate honestly. The bridge accepted deposits, credited balances, and returned confirmations. Users who tested small amounts first got their money back or saw correct accounting. Explorer data populated. The system behaved exactly like a functioning bridge because, functionally, it was one.

Phase two: pivot. At a chosen moment — approximately twelve hours in — the operator modified the bridge's entry behavior. This was not an exploit of an existing function. It was a change to what the function did. And then they executed once, moving 766 ETH to an address they controlled.

The technical implication is worth stating plainly, because it reframes the entire incident. The 767 ETH users deposited never sat in a contract designed to lock them. They sat in, or were routed to, a Safe multisig controlled by the operator. The "bridge" was a shopfront. The vault was the operator's own wallet.

This is why the capture rate hit 99.87%. There was no liquidity to drain against, no pool to imbalance, no oracle to manipulate. There was a doorway, and the doorway was moved to a different room's door.

I have seen this architectural pattern before. During the 2017 ICO code audits I ran out of Singapore, the fatal contracts were rarely the ones with elegant bugs. They were the ones where the deployer retained a mutable entry point and no timelock, and the audit checklist said "owner functions present" without asking what the owner could do with them at block N+1.

Administrative mutability is the most reliable precursor to loss in this entire asset class. Not reentrancy. Not integer overflow. Mutability with no delay and no observability.

Part III — Following the 767 ETH: A Balance Sheet of Theft

Now follow the money, because the movement pattern tells you who you are dealing with.

Inbound: 1,333 wallets deposited a combined 767 ETH across roughly thirteen hours. That averages to about 0.575 ETH per wallet. Read that number again. It is a retail distribution, not a whale operation. This was not three funds making a size bet. This was over a thousand individuals, most of them depositing amounts that in Korean retail terms represent a meaningful but survivable position — the classic profile of airdrop farming capital.

Outbound: 766 ETH moved in a single transaction to an operator-controlled address. The one ETH left behind is the residue of gas and dust. Nothing was deployed to a mixer from the bridge itself. The exit was clean.

Then the split: 177 ETH entered Tornado Cash. 589 ETH dispersed across four separate wallets and, as of the reporting window, had not moved.

That split is a decision, and decisions reveal intent.

Tracing the ghost in the smart contract code means reading the post-theft behavior as an operational document. The actors routed approximately 23% of the proceeds through a mixer whose contract has been sanctioned by the U.S. Treasury's Office of Foreign Assets Control. They left roughly 77% sitting in four wallets.

That is not the pattern of a novice. A novice dumps everything into one mixer deposit or, worse, sends straight to a centralized exchange. This operator compartmentalized: a tumbling tranche for immediate obfuscation, and a dormant tranche for patient disbursement once the attention window closes.

Silence in the logs speaks louder than the pump. Four wallets holding 589 ETH and doing nothing is not inaction. It is patience. Those addresses will be watched by every analytics desk in the industry for the next several months, and the operators know it. The question is not whether they move. It is whether they move in a way that touches a compliant venue, because that is when the freezing window — measured in hours, not days — opens and closes.

Mapping the liquidity that never was is the final piece of this section. There is a tendency to read a $2 million figure and file it under "small." Against Upbit's daily volume, $2 million is a rounding error. But that framing misses what the money actually represents: it is the aggregate of 1,333 individual decisions made under a shared belief that a specific chain was safe to touch. The liquidity that never existed was not the ETH. It was the trust.

Part IV — The Pre-Mainnet Window Is a Structural Vacuum

I want to be precise about where the failure lives, because the instinct to blame the victims is both lazy and analytically useless.

The victims did what early adopters are structurally incentivized to do. They treated a pre-mainnet environment as an opportunity. That is not naivety; it is a rational response to three years of exchange-adjacent chains rewarding early participants with disproportionate allocations. The behavior was trained into them by the market.

The attackers did not create that incentive. They exploited a window that the incentive created.

And the window is real, measurable, and recurring. It opens when a chain's identity — its name, its chain ID, its branding — becomes public, and it closes only when the operator publishes verifiable, signed, authoritative network parameters. Between those two points, the identity is public but unsecured. Anyone can wear it.

This is the single most under-defended period in the lifecycle of any new L2. Not the launch. Not the token generation event. The anticipation phase, when the brand exists and the verification infrastructure does not.

What should have existed in that window — and what I expect every OP Stack team to be pressured into publishing after this event — is a signed RPC whitelist, a published bridge contract address with an on-chain deployment transaction timestamped before any user interaction, and a canonical verification path that does not route through the same endpoint being verified.

The absence of those artifacts is not a GIWA-specific failing. It is an industry-wide standard gap. GIWA responded defensively on X, denying that any official mainnet RPC had been exposed and reiterating that mainnet had not launched. That statement is almost certainly technically accurate. It is also insufficient, because it does not give a user any way to distinguish the real thing from the fake one before the real thing exists.

I have watched this exact dynamic before, in a different market. In 2021, I spent three months reverse-engineering order book data to separate wash trading from organic demand in a major NFT collection. The mechanism was different — spoofed volume rather than spoofed infrastructure — but the logic was identical. When the verification tool is controlled by the party being verified, the verification is theater.

Part V — A Risk Simulation of the Capture Rate

I build Monte Carlo models for stablecoin and bridge stress scenarios. It is a habit that started after the 2022 collapse cycle, when I ran 10,000 withdrawal iterations against reserve-backed designs and found that any structure without provable immediate liquidity failed under stress — not sometimes, but deterministically.

I applied the same lens here, and the result is instructive.

Model the scenario as it appeared to a depositor at hour one. Unknown operator. Unaudited bridge. No published deployment record. A chain ID that matched pre-release documentation. The observable signals available to a user without forensic tooling were, in aggregate, indistinguishable from a legitimate pre-launch environment.

The differentiator was never going to be found by a retail depositor in thirteen hours. It was going to be found by checking whether the bridge's admin functions were behind a timelock and whether the deployment transaction predated the community announcement.

Run the capture rate. One thousand simulated deposit cohorts, each entering at a random hour across the thirteen-hour window, each with a random withdrawal probability based on observed 0.575 ETH average position sizes and typical early-user behavior. In the overwhelming majority of iterations, the outcome converges on near-total loss for anyone who entered before hour twelve.

That is the finding. The capture rate was not an anomaly. It was the mathematically expected result of the design. When deposits route to a mutable operator-controlled vault, near-total extraction is the default, not the edge case.

And notice what this means for the attackers' risk profile. Their cost basis was infrastructure time, a small initial funding transfer through ChangeHero on September 26, and Safe deployment gas. Their revenue was approximately $2 million. That is not a scam with a business model. That is a scam with a capital efficiency ratio that most legitimate startups would envy.

Part VI — The Compensation Arithmetic: Forty Percent of What, Exactly

DYORSWAP's response deserves its own audit, because compensation announcements are a genre of marketing document and should be read that way.

The plan as described: users who deposited less than 5 ETH receive 40% compensation. Users above 5 ETH are subject to individual review. The project also indicated it would require identity and address verification for larger claims, and reserved a mechanism to exclude what it characterizes as malicious large depositors.

Start with the first tier. A 40% recovery against a 100% loss is a 60% permanent impairment for the smallest participants — the exact cohort least able to absorb it, and the cohort that I calculated above as constituting the bulk of the 1,333 wallets at 0.575 ETH average.

Now the second tier, where the real ambiguity lives. Every claimant above 5 ETH faces a review process with undisclosed criteria, an identity verification requirement, and an explicit exclusion mechanism for bad actors. Each of those three elements independently reduces expected payout. Combined, they convert a compensation plan into a discretionary fund.

A compensation promise with an undisclosed review standard is not a liability. It is an option, held by the party promising it.

I want to be fair here, because the incentive structure is genuinely complicated. DYORSWAP was itself a victim — it interacted with the fake network early and issued the warning. Compensating users out of its own balance sheet is a reputation expenditure, not a protocol revenue distribution. There is no mechanism by which it is obligated to pay anything. That it is paying something is more than most ecosystem participants would do.

But the arithmetic still has to be stated honestly. The average small depositor recovers 40%. The average large depositor recovers an unknown fraction, possibly zero. The headline number — whatever aggregate figure gets quoted — will describe a commitment ceiling, not an expected payout.

There is a second-order risk that deserves flagging. If DYORSWAP's own treasury is not deep enough to cover the tier-one obligations at scale, the compensation plan converts from a goodwill gesture into a second trust event. And a second trust event is worse than the first, because this one would be voluntary.

The identity verification requirement is the quiet filter in the design. Users in privacy-sensitive jurisdictions, users who deposited from hardware wallets they cannot easily link to identity documents, users who simply do not want to hand personal data to a DeFi project — all of them will rationally decline. Every declined claim is a dollar that stays in the project's wallet. That is not a conspiracy. It is how voluntary compensation programs mechanically behave.

Contrarian: This Was Not an Exploit, and That Is the Frightening Part

Here is where I break with the consensus reading of this event.

The dominant narrative is that a fake chain exploited a security gap. Implied in that framing is a fix: patch the gap, improve user education, add a verification widget to wallets, and the class of attack is mitigated.

I do not believe that. I think the operational lesson is nearly the opposite of what people are concluding.

The attackers did not exploit a bug. They exploited a business process. The process is: publish an identity, generate anticipation, and let users self-onboard before the verification infrastructure exists. That process is not a defect in GIWA. It is how every exchange-backed chain in this market generates its initial user base.

You cannot patch a business process with a widget. You can only change who bears the verification burden — and right now, that burden sits entirely on the user, who has no cryptographic tool to discharge it. There is no signed chain registry. There is no authoritative RPC attestation standard. There is no way for a wallet to confirm that the endpoint telling it "this is network 9134" is the same endpoint the operator intended.

Second, and more uncomfortable: the correlation between DYORSWAP's rapid response and the conclusion that it behaved admirably is not causation. Speed of response in a crisis is a reputational asset with a remarkably favorable exchange rate. A project that did not exist on most people's radar twenty-four hours ago is now the most-discussed entity in this story. That is not a criticism of its motives. It is an observation about incentives — and I do not grade announcements by their sincerity, only by their verifiable content. The verifiable content here is 40%, a review process, and an exclusion clause.

Third, the reflex to blame users. I have audited contracts for nine years and I can tell you that the users who lost money here were not the careless ones. The careless ones deposited 0.02 ETH to test. These were 1,333 wallets averaging over half an ETH each, engaging with a chain they had researched, in a market that has spent three years telling them that early is the only alpha that matters. They were behaving exactly as the market trained them to behave. A system that punishes its most attentive participants is not a system with careless users. It is a system with a verification deficit.

Finally, and this is the contrarian conclusion that matters most for the next twelve months: I expect this attack class to be repeated, not deterred. The cost-benefit ratio is too extreme, the pre-mainnet window is structural, and the legal friction is nearly total. The attackers used a mixer that is already sanctioned, a swap service with minimal KYC, and a multisig. They were operating in a jurisdiction-agnostic stack from the first block. There is no realistic path to recovery for most of that 766 ETH.

Takeaway: Four Wallets, One Whitelist, and a Thirteen-Hour Clock

Watch four things over the next quarter.

Four wallets holding 589 ETH. If any one of them touches a compliant venue, the freezing window is measured in hours. If they stay dormant past ninety days, the proceeds have been successfully laundered by attrition, and the operators will run this playbook again on the next unlaunched chain that generates a queue.

Whether GIWA publishes a signed RPC whitelist and a timestamped bridge deployment record before mainnet. If it does, it becomes the template and every OP Stack team behind it inherits a new minimum standard. If it does not, the anticipation window stays open, and the next fake chain will be more convincing than this one — because it will have this one's playbook to copy.

The Korean regulatory response. Dunamu is a licensed provider with user-protection obligations. A fake network wearing its subsidiary's identity, draining 1,333 wallets through an unverifiable RPC endpoint, is a question regulators will ask whether or not anyone was legally at fault.

And the compensation payout ratio against the announced ceiling. That number, once it prints, tells you whether ecosystem goodwill in this market is a balance sheet item or a press release.

Every mint leaves a digital scar. The blockchain remembers what the founders forget — including the chain ID they announced eight months before they were ready to defend it.

The data suggests the real vulnerability here was never in the code. It was in the gap between the announcement and the artifact. That gap is still open. It is open on every L2 currently telling its community to get ready. Somewhere, right now, someone is reading that announcement and thinking about what to build.