DYORSWAP users lost 766 Ether (ETH) through a counterfeit GIWA bridge that spoofed the protocol's official chain ID 9134, according to Crowdfund Insider.

The fraudulent contract surfaced in connection with DYORSWAP, a swap protocol, and used GIWA's legitimate chain identifier to pass standard verification. Crowdfund Insider reported the 766 ETH drain without specifying the deployment date of the malicious contract, the number of wallets affected, or whether any recovery effort is underway.

What is chain-ID spoofing?

Chain IDs are unique numerical identifiers assigned to individual blockchain networks under Ethereum's EIP-155 standard. They were introduced to prevent transaction replay across networks and now serve as a primary signal for wallets, block explorers, and decentralized applications to confirm that a user is transacting on the intended chain.

When a malicious actor deploys a contract that reuses the official ID of a recognized protocol, users who verify only chain identity can be deceived into authorizing transactions on a parallel network. The mechanism weaponizes a piece of metadata originally designed as a security feature. It costs the attacker nothing beyond deploying a contract on any compatible chain and exposes victims only at the moment of signing.

Why are bridges particularly exposed?

Cross-chain transactions already require users to interact with unfamiliar interfaces, where visual and metadata-based verification tend to replace deeper contract inspection. Most consumer wallets display the chain ID alongside the network name and a colored badge, but few verify that the displayed ID matches the user's expected destination at the contract level.

The counterfeit GIWA bridge inherited ID 9134, allowing it to pass basic legitimacy checks performed by standard wallet interfaces. The attack required no compromise of GIWA's actual contracts, and on-chain forensics would likely confirm only that user funds were signed over to attacker-controlled addresses. Bridges are a high-value target across the industry because they aggregate liquidity from multiple chains and routinely process large transfers during user routing windows.

What does the incident reveal?

The exploit adds to a catalog of bridge-related losses that have collectively drained billions of dollars across the crypto sector. Unlike smart-contract logic bugs, chain-ID spoofing targets the verification layer where metadata is presented without cryptographic proof of origin. An attacker mirroring a known protocol's branding and chain identifier can deceive users through the very checks designed to protect them.

Operators typically advise users to verify contract addresses through official documentation rather than relying on chain identifiers alone. The GIWA incident demonstrates that even disciplined users can be deceived when attackers faithfully replicate the metadata surrounding a transaction. Wallet providers across the ecosystem have begun discussing stronger provenance signals — deployment timestamps, verification status, and audited-source badges — though adoption remains uneven.

What comes next?

GIWA has not, in Crowdfund Insider's reporting, acknowledged the counterfeit contract. DYORSWAP has not been tied to any compensation framework. Wallet providers now face renewed pressure to surface additional provenance data before users sign bridge transactions. The episode will likely sharpen regulatory and operational scrutiny of metadata-based trust signals across cross-chain tooling, particularly at decentralized exchanges where users self-route through unfamiliar bridge contracts.