DYORSWAP has compensated users affected by the "fake GIWA mainnet" incident with over 200 ETH, and the investigation into the matter remains ongoing.

Multichain DEX DYORSWAP has released an official statement on the "False GIWA Mainnet 9134 Incident", clarifying that this was not an attack on DYORSWAP’s contracts, but rather the project and its users were affected by a fake network impersonating the GIWA Mainnet 9134. This network features a bridge and batcher similar to OP Stack, and was deployed at 02:10:59 (UTC+8) on September 27, 2026. Approximately 8.5 hours before deployment, the address received around 0.045 ETH from an address associated with ChangeHero. Just 39 blocks after the bridge went live, three deposits totaling 0.4 ETH entered in the same second, two of which were the first outgoing transactions from their respective wallets. DYORSWAP believes these addresses strongly match the characteristics of internal test wallets. The fake L2 then began operating normally and posted transaction batches to the Ethereum mainnet. Data shows that a total of 1,335 addresses deposited approximately 767.65 ETH into the bridge, with roughly 766.25 ETH ultimately siphoned off. The siphoning transactions occurred in Ethereum block 26067309. The DYORSWAP team stated that it has distributed more than 200 ETH to affected users using its own funds, adding that the investigation is ongoing and will trace the deployer, source of funds, test wallets, batcher infrastructure, and the destination of the siphoned funds.