Blockchain security platform Forta published an investigation on November 10 into a cluster of wallets on BNB Chain — the network launched by the team behind the Binance exchange — that has kept 32 counterfeit dollar tokens trading at roughly $1 since February, one after another, by routing them through pools on PancakeSwap, the largest decentralized exchange on BNB Chain, that reject any trade from a wallet outside the operators’ own allowlist. The tokens carry Tether’s name and logo (imitating USDT, the most widely used dollar-pegged stablecoin), arrive as ordinary transfers, and are handed over as payment for goods. Sellers generally discover what they actually hold only when they try to sell, according to Forta’s report.

One seller described that moment to Forta. They had sold items from an online game for a four-figure amount in what the wallet labelled USDT on BNB Chain, complete with Tether’s branding and a matching dollar total. The deposit to an exchange produced no credit. The token was one of the 32.

How a fake token gets a $1 price

The counterfeit is a standard BEP-20 contract — BNB Chain’s version of the ERC-20 token standard — whose name and symbol fields are free text. Forta found that the fakes in this rotation are 45-byte clones of a launchpad token template, with “USDT” and “Tether USD” typed out using letters from other alphabets that render like Latin ones. Some add invisible zero-width characters inside the ticker. The names survive a casual glance and most wallet displays.

A name alone would show no price. To supply one, the operators pair each fake with real USDT in a PancakeSwap Infinity pool. Infinity pools accept custom hooks: code attached by the pool creator that runs on every trade. The hook on these pools accepts a swap only from wallets on the operators’ allowlist. A keeper wallet — automated software performing a routine DeFi maintenance role — then round-trips small trades through the pool every few minutes, keeping the last recorded price between $0.99 and $1.005. On one token, the keeper made 9,522 swaps in four days.

Price trackers, block explorers and wallet apps read that last trade and attach it to every balance of the token, anywhere. A seller’s wallet shows $1 per unit because a pool reported $1 per unit; it has no way of knowing that the only wallets able to trade in the pool belong to the people who created the token. Forta simulated a sale from an outside wallet at the midpoint of each pool’s active period, and the hook refused all 32.

The operators also cover the gas. Forta found that every transfer in the case it traced, including the victim’s later move to an exchange, went out at a gas price of zero, with a sponsor wallet paying in the same block under BNB Chain’s gasless BEP-414 pattern. The buyer needed no BNB, and the seller never saw an unusual fee. At the crew’s purchase price, $5 bought 215,786 fake dollars; the entire four-figure payment cost the sender one to two cents.

Why the transfer still confirms

Nothing about the transaction is forged. Take a seller who agrees to receive 500 USDT. The buyer sends 500 units of the clone. The block confirms, the explorer shows a transfer of 500, and the wallet displays $500. Each step is accurate about the contract it describes; the seller simply never checked which contract it was. These are direct person-to-person deals — Forta’s cases range from game items and Telegram collectible gifts to an investment payment — with no exchange or marketplace in the middle to check which contract arrived before the goods move.

That is the gap a name cannot close. Confirmation proves that a given contract recorded a movement of tokens. It says nothing about whether that contract is the one Tether issued, and the ticker, logo and dollar total all come from fields and feeds that the fake’s issuer controls.

The seller sees one figure on screen, but three different quantities sit behind it, and only the last one is money. The same split explains the exchange deposit that went nowhere: an exchange credits USDT only when the deposit comes from the contract it has listed, so a clone arriving at a deposit address is just an unknown token sitting in an exchange wallet. That is how the seller who contacted Forta learned what had happened.

What $22 million does and doesn’t count

Forta ties the 32 pinned tokens to a wider set of at least 151 lookalikes — 115 of them dollar copies, the rest imitating BTC, BNB or ETH — which together carried 3,138,110 transfers by November 3. Monthly traffic ran at 28,000 to 52,000 transfers until the first keeper wallet appeared in February, then climbed to a peak of 814,457 in August.

Of the receiving addresses, 266,497 received amounts that look like purchases — 20 to 20,000 fake dollars from a sender who paid few others — and about 37,000 of them had previously sent real funds to a major exchange. Valuing what they received at the $1 their wallets displayed gives roughly $22 million, within a range of $11 million to $34 million; counting only the 32 pinned tokens gives about $4 million.

Forta is explicit that neither figure is a loss. The set includes buyers, spam targets and test wallets, and because a fake token costs about a thousandth of a cent, the amounts are free to inflate: after stripping out airdrop-style sprays, the median receiver got 26 fake dollars. The real loss is whatever each seller handed over, which leaves no record on the chain. On-chain, the 13-wallet buyer crew Forta traced took in $11,368 in real stablecoins and sent out $11,054 over fifteen months; its profit, if any, is the goods.

Three public reports on Chainabuse, a platform where anyone can flag crypto scams, match tokens from the same rotation, each tied to its transaction. Seven Telegram collectible gifts agreed at $600 were paid with 650 fake tokens on July 30. A buyer who said they had sent 500 USDT on September 2 had in fact sent 500 clones. In an investment-scam case, 13,102.81 real USDT left a victim’s wallet on June 1, and 13,201 fake tokens arrived 65 seconds later. Forta found no link between those senders and the crew in its own case. Coindoo has not independently reproduced the tracing or the pool simulations.

What to check before releasing anything

Binance’s fake-payment guidance, published in September, sets the order: agree on the network, the contract address and the amount before the deal, then inspect what actually arrived before any goods, keys or accounts change hands. Forta adds the reference point that makes the first step possible.

USDT on BNB Smart Chain, shown on BscScan, the network’s block explorer, as Binance-Peg BSC-USD: 0x55d398326f99059fF775485246999027B3197955

This is the Binance-issued BEP-20 token backed by USDT — the one exchanges and wallets treat as USDT on this network. On BscScan the contract appears as “Binance-Peg BSC-USD”, with the legacy label “BUSD-T Stablecoin”; both refer to the same Binance-issued token. Compare the full address, not just the first and last characters: the clones in this case end in “8888”, a vanity suffix their launchpad assigns.

Do not test an unfamiliar token by trying to sell it. Selling through a decentralised exchange means approving that token’s contract to move funds from the wallet, and a contract chosen by someone else is not one to grant that permission to. Depositing it to an exchange proves nothing either, as the seller above found. Leave the token where it is, keep the contract address and transaction hash, and raise the issue with the wallet provider through its official support channel.

The screen is not the market

The pattern is the same one Coindoo identified in wallets that look profitable without making money: the screen reports what the chain recorded, not what can actually be taken out. A payment is received when the agreed contract, on the agreed network, shows the agreed amount. A $1 price in a wallet is a quote from a market; in this case, it was a market with one set of doors, and the seller was on the wrong side of them.

Based on Coindoo’s report: Fake USDT on BNB Chain: The $1 Is Real, the Exit Isn’t.