What happened?
According to a Cointelegraph report, the decentralized exchange (DEX, a protocol for swapping tokens without a central intermediary) DYORSWAP became the victim of a scam in which attackers used a fake network impersonating the GIWA blockchain. The result was a loss of ETH worth approximately $2 million.
The core of the problem is simple: there was a fake version of the GIWA network that scammers presented as the real one. DYORSWAP apparently treated it as a legitimate environment, which allowed the attackers to drain the funds.
What is GIWA and why does it matter?
GIWA is a project linked to Dunamu, the operator of the South Korean crypto exchange Upbit. The key detail that frames the entire case is stated by Cointelegraph itself: according to Dunamu, GIWA had not yet launched its mainnet at the time of the incident, meaning the live, fully functional network.
That is crucial. If the official network was not yet running, then any "GIWA network" being worked with at that moment could not have been the real one. It was precisely this gap between expectation (a well-known name associated with Upbit) and reality (no live mainnet) that the scam exploited.
How much did DYORSWAP pay out?
According to Cointelegraph, DYORSWAP said it paid out more than 200 ETH in compensation. The total loss mentioned hovers around $2 million in ETH.
| Metric | Value (per Cointelegraph) |
|---|---|
| Estimated loss | ~$2 million in ETH |
| Compensation paid out | over 200 ETH |
| GIWA mainnet status | per Dunamu, not yet launched |
What is not confirmed yet?
Caution is needed here. The available source does not reveal the exact technical mechanism of the attack, meaning whether it involved spoofed smart contracts, fake RPC or documentation, social engineering, or a combination. Nor does this source confirm who exactly is behind the attack, whether the funds were traced or frozen, or how exactly the compensation was calculated and distributed among affected users.
We do not want to infer a cause where the source does not state one. We stick to what has been documented.
What to watch out for with this type of incident
This is not advice on what to do with your money, but a list of patterns that recur in similar cases and that can be verified:
- Verified network identity. Before integrating a new network, it helps to confirm the official announcement from the operator itself. In this case the operator (Dunamu) explicitly stated that the mainnet was not yet running.
- The difference between testnet and mainnet. A well-known project name does not mean that the specific network you are working with is the real, live one.
- Chain ID and official contracts. For integrations, you verify that the network identifiers and addresses match official sources, not just the name.
Charliedesk is not making further predictions about this case. We record what demonstrably happened and what remains open. If verified information emerges about the attack mechanism or the fate of the stolen funds, we will return to it.