someone faked an entire blockchain and walked away with $2m in a few hours. worst part is people sent the money themselves. here's what happened with the fake giwa mainnet: giwa is the ethereum L2 from upbit (korea's biggest exchange). mainnet isn't live yet. only testnet. but the future chain id is public: 9134. 1. the scammer made a fake chain using the real chain id 9134 2. sets up a fake rpc + a fake bridge on ethereum 3. a fake account in dyorswap's community drops the "leaked" giwa rpc 4. dyorswap checks the chain id, sees 9134, and deploys its launchpad on it 5. influencers spread it: "giwa mainnet is unofficially live, bridge now" 6. memecoins start pumping on the fake chain. it all looks real 7. 1,333 wallets bridge 766 eth (~$2.08m) 06:09 utc: giwa posts that mainnet isn't live and no rpc could have leaked. people keep bridging. 07:29 utc: the bridge owner drains all 766 eth in one tx. where the money is now: - 227 eth already sent through tornado cash - 539 eth split across 2 wallets dyorswap is refunding 40% to wallets that bridged under 5 eth, from its own treasury. anything above 5 eth is "under review". the correction came out 1h20 before the drain. fomo was just faster. sources: drain tx (766.25 eth): https://t.co/y0icDW7yTK giwa, 06:09 utc, "mainnet isn't live": https://t.co/AkVg9oFCht dyorswap incident notice: https://t.co/ye9TqrsEML dyorswap 40% refund plan: https://t.co/TKoNZuNJXq timeline by @stablemark_: https://t.co/j5TLMLli93