A fake Upbit-backed GIWA mainnet lured 1,333 wallets before attackers changed the bridge code and drained 766 ETH.