Fake USDT on BNB Chain: The $1 Is Real, the Exit Isn’t
A counterfeit stablecoin can land in a wallet through an ordinary BNB Chain transfer, show Tether’s name and a $1 price, and still be impossible for its recipient to sell.
Key Takeaways
- Forta traced 32 fake dollar tokens pinned near $1
- Only operator wallets could trade in those pools
- Wallets display the pool’s price as real value
- Check the contract address before releasing goods
Forta’s November 10 investigation follows a group of wallets on BNB Chain that has kept 32 counterfeit dollar tokens trading at about $1 since February, one after another, by running them through PancakeSwap pools that reject trades from anyone outside the operators’ own list. The tokens carry Tether’s name and logo, arrive as normal transfers, and are handed over as payment for goods. The sellers find out what they hold when they try to sell it.
One seller described that moment to Forta. They had sold items from an online game for a four-figure amount in what the wallet labelled USDT on BNB Chain, with Tether’s branding and a matching dollar total. The deposit at an exchange produced no credit. The token was one of the 32.
How a fake token gets a $1 price
The counterfeit is a standard BEP-20 contract, the BNB Chain version of the ERC-20 token standard, whose name and symbol fields are free text. Forta found the fakes in this rotation are 45-byte clones of a launchpad token template, with “USDT” and “Tether USD” typed in using letters from other alphabets that render like Latin ones. Some add invisible zero-width characters inside the ticker. The names survive a casual glance and most wallet displays.
A name alone would show no price. For that, the operators pair each fake with real USDT in a PancakeSwap Infinity pool. Infinity pools accept custom hooks, code the pool creator attaches to run on every trade. The hook on these pools accepts a swap only from wallets on the operators’ allowlist. A keeper wallet then round-trips small trades through the pool every few minutes, so the last recorded price stays between $0.99 and $1.005. On one token the keeper made 9,522 swaps in four days.
Price trackers, explorers and wallet apps read that last trade and attach it to every balance of the token, anywhere. The seller’s wallet shows $1 per unit because a pool reported $1 per unit; it has no way to know that the only wallets able to trade there belong to the people who created the token. Forta simulated a sale from an outside wallet at the midpoint of each pool’s active period, and the hook refused all 32.
Token minted from a launchpad template for a fraction of a cent
Paired with real USDT behind a hook that admits only operator wallets
Keeper trades keep the last price at $1 for days or weeks
Buyer crew sends the fake as payment; wallet multiplies by $1
The operators also cover the gas. Forta found every transfer in the case it traced, including the victim’s later move to an exchange, went out at a gas price of zero, with a sponsor wallet paying in the same block under BNB Chain’s gasless BEP-414 pattern. The buyer needed no BNB, and the seller never saw an unusual fee. At the crew’s purchase price, $5 bought 215,786 fake dollars; the entire four-figure payment cost the sender one to two cents.
Why the transfer still confirms
Nothing about the transaction is forged. Take a seller who agrees to receive 500 USDT. The buyer sends 500 units of the clone. The block confirms, the explorer shows a transfer of 500, and the wallet shows $500. Each step is accurate about the contract it describes; the seller simply never checked which contract that was.
That is the gap a name cannot close. Confirmation proves a given contract recorded a movement of tokens. It proves nothing about whether that contract is the one Tether issued, and the ticker, logo and dollar total all come from fields and feeds the issuer of the fake controls.
Three numbers that look like one
The seller is looking at one figure on screen, but three different quantities sit behind it, and only the last one is money.
| Figure | Where it comes from | In this case |
|---|---|---|
| Unit price | Last trade in a pool | $1, set by the keeper |
| Wallet total | Balance × unit price | Matches the agreed amount |
| Proceeds | What a sale returns | Nothing; outside wallets refused |
The same split explains the exchange deposit that went nowhere. An exchange credits USDT only when the deposit comes from the contract it has listed. A clone arriving at the deposit address is just an unknown token sitting in an exchange wallet, which is how the seller who contacted Forta learned what had happened.
What $22 million does and doesn’t count
Forta ties the 32 pinned tokens to a wider set of at least 151 lookalikes, 115 of them dollar copies and the rest imitating BTC, BNB or ETH, which together carried 3,138,110 transfers by November 3. Monthly traffic ran at 28,000 to 52,000 transfers until the first keeper appeared in February, then climbed to a peak of 814,457 in August.
Of the receiving addresses, 266,497 got amounts that look like a purchase, 20 to 20,000 fake dollars from a sender who paid few others, and about 37,000 of those had previously sent real funds to a major exchange. Valuing what they received at the $1 their wallets displayed gives roughly $22 million, within a range of $11 million to $34 million; counting only the 32 pinned tokens gives about $4 million.
Forta is explicit that neither figure is a loss. The set includes buyers, spam targets and test wallets, and because a fake token costs about a thousandth of a cent, the amounts are free to inflate: after stripping out airdrop-style sprays, the median receiver got 26 fake dollars. The real loss is whatever each seller handed over, which leaves no record on the chain. Onchain, the 13-wallet buyer crew Forta traced took in $11,368 in real stablecoins and sent out $11,054 over fifteen months; its profit, if any, is the goods.
Three public reports on Chainabuse match tokens from the same rotation, each one tied to its transaction: seven Telegram collectible gifts agreed at $600, paid with 650 fake tokens on July 30; a buyer who said they had sent 500 USDT on September 2 and had sent 500 clones; and an investment-scam victim whose 13,102.81 real USDT left their wallet on June 1, with 13,201 fake tokens arriving 65 seconds later. Forta found no link between those senders and the crew in its own case. Coindoo has not independently reproduced the tracing or the pool simulations.
What to check before releasing anything
Binance’s fake-payment guidance, published in September, sets the order: agree the network, the contract address and the amount before the deal, then inspect what actually arrived before any goods, keys or accounts change hands. Forta adds the figure that makes the first step possible.
USDT on BNB Smart Chain (shown on BscScan as Binance-Peg BSC-USD)
0x55d398326f99059fF775485246999027B3197955
This is the Binance-issued BEP-20 token backed by USDT, the one exchanges and wallets treat as USDT on this network.
On BscScan this contract appears as “Binance-Peg BSC-USD”, with the legacy label “BUSD-T Stablecoin”; both refer to the same Binance-issued token. Compare the full address, not the first and last characters; the clones in this case end in “8888”, a vanity suffix their launchpad assigns.
Do not test an unfamiliar token by trying to sell it. Selling through a decentralised exchange means approving that token’s contract to move funds from your wallet, and a contract you did not choose is not one to grant that permission to. Depositing it to an exchange proves nothing either, as the seller above found. Leave it where it is, keep the contract address and transaction hash, and raise it with the wallet provider through its official support channel. The pattern is the same one Coindoo found in wallets that look profitable without making money: the screen reports what the chain recorded, not what you can take out.
A payment is received when the agreed contract, on the agreed network, shows the agreed amount. A $1 price in the wallet is a quote from a market; in this case it was a market with one set of doors, and the seller was on the wrong side of them.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
