Fraudsters clone Dunamu's Kaia Chain before launch, drain virtual assets
Fake RPC, chain ID and bridge deployed; DEX transactions nearly impossible to reverse
A new type of fraud has emerged in which scammers build a counterfeit blockchain network modeled on a well-known virtual asset operator's unreleased platform and use it to steal investors' assets. Financial authorities warned that users must verify whether a network has been officially launched before engaging with it, as assets drained through on-chain transactions are nearly impossible to recover.
The Financial Supervisory Service issued a consumer alert at the "Caution" level Thursday.
In a recently confirmed case, a fraud ring built a fake network impersonating Kaia Chain — a blockchain network under development by Dunamu — before its official launch. The group then spread false claims through SNS and online communities, including announcements of a "surprise mainnet launch," to lure users in.
The fraudsters did not merely steal the name. They constructed a network that closely resembled a real blockchain, replicating the remote procedure call (RPC) address used to connect to the network, the chain ID, and a bridge for transferring virtual assets between different blockchains.
The official chain ID for Kaia Chain's network is 91342, while the fake network used 9134. At the time, the official Kaia Chain network had not yet launched.
The problem was compounded when a decentralized exchange (DEX) treated the fake network as legitimate. DYOR Swap, a DEX, recognized the fraudulent network as a valid chain and supported it, leading users to deposit Ethereum through the fake bridge.
The fraud ring then moved all the virtual assets that had flowed through the bridge to external wallets in one sweep. The FSS said on-chain fraud is particularly difficult to remedy because funds can be moved and stolen within minutes to hours, and there is no central authority to cancel transactions or recover assets.
The FSS said any bridge or smart contract claiming to support the mainnet of a network that has not yet officially launched or is still in development should be treated as fraudulent. When information about a new network surfaces, users should first verify it through the developer's official website or official accounts.
In particular, the FSS said users should be suspicious of fraud or phishing whenever promotional language not confirmed through a developer's official channels — such as "surprise launch," "airdrop" or "early participation event" — is used to prompt asset transfers.
The FSS also urged caution when using DEXs. A DEX is only an interface that connects transactions; it has no centralized operator that directly controls assets or trades. If virtual assets are mistakenly sent as a result of fraud, reversing the transaction or obtaining relief is in effect impossible.
Going forward, the FSS said it plans to require virtual asset operators developing new blockchains to disclose their development progress and provide relevant investor advisories.
Meanwhile, FSS Governor Lee Chan-jin told the National Assembly's Political Affairs Committee during a national audit Monday that swift action is critical in on-chain fraud cases because funds move within a very short time, citing the fake Kaia Chain mainnet incident. Democratic Party of Korea lawmaker Min Byeong-deok raised the case at the same hearing, noting that 2.8 billion won ($2.11 million) had been transferred within half a day, and called for dedicated blockchain forensics personnel and clearer supervisory standards for major virtual asset exchanges.
rim@heraldcorp.com
