DYORSWAP users tricked into sending 767 ETH to fake bridge contract
Crypto scammers managed to trick DYORSWAP, a multi-chain decentralized exchange, into integrating a spoofed version of upcoming blockchain GIWA over the weekend, leading to losses of $2 million.
Over one thousand users eager to be early to a new chain sent a total of 767 ETH to the fake bridge contract, which was later withdrawn by the scammers before the proceeds were funnelled into Tornado Cash.
Read more: Bitget’s eighth birthday ends with a $352M hack
Shortly after the bridged funds were drained, DYORSWAP admitted that “the so-called GIWA Mainnet we previously identified was in fact a fake chain set up by scammers.”
Ironically, DYORSWAP takes its name from the abbreviation of the popular phrase “do your own research,” which is often touted as the key to staying safe in crypto.
In using the same chain ID as the legitimate GIWA network, 9134, the falsified OP Stack chain was made to “appear legitimate during [DYORSWAP’s] initial verification.”
DYORSWAP’s statement also mentions “specific suspicious messages” which may have planted the false information among the DYORSWAP community.
The spoofed bridge, which had been deployed shortly after 6 PM UTC on Saturday, was drained just over 12 hours later.
DYORSWAP offered users who had bridged less than five ETH a 40% refund. Addresses that surpassed that threshold are to be considered on a case by case basis.
That’s not my chain
“Powered by UPbit,” the South Korean centralized exchange, GIWA is an upcoming Layer 2 network, built on the OP Stack, which launched its testnet last year.
The official GIWA X account was forced to emphatically debunk the existence of its mainnet. However, the post came too late, just minutes before the fake GIWA bridge contract was emptied.
One onlooker called the heist “social engineering at the highest level.”
Read more: DeFi hack attack: Three exploits snatch $11M in a single day
DYORSWAP published a later update identifying addresses that, “based on timing and behavior,” it believes were behind the scam, funded from exchanges Binance and Gate.
The post also tallied 1,335 addresses which had bridged a total of 767.65 ETH, almost all of which was later drained.
It paints DYORSWAP as a victim alongside its users, and claims to have distributed over 200 ETH in compensation.
An address claiming to be from the DYORSWAP team has reached out to the scammers on-chain requesting the return of the stolen funds.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.