Fake USDT could show a convincing dollar balance in a wallet while its holder was unable to sell it through the market supplying that price, according to a Nov. 10 investigation by blockchain security firm Forta.
The researchers identified 32 tokens whose prices were maintained in successive periods by wallets repeatedly trading through restricted pools. When Forta simulated an outside wallet trying to sell at the midpoint of each pool’s active window, all 32 rejected the swap.
That left a gap between the dollar value a wallet could display and the value an ordinary holder could obtain through the identified market. A familiar token name, a completed transfer and a convincing balance could all appear together for a seller accepting crypto without delivering the genuine asset.
The price came from a closed market
Forta traced the pricing mechanism to PancakeSwap Infinity pools pairing counterfeit tokens with real USDT. Automated wallets, which the researchers call keepers, repeatedly made small round-trip trades to keep the latest pool price near a dollar.
The pools’ swap hooks restricted trading to wallets on the operators’ allowlists. The keepers could maintain the quotation while an outside holder’s attempt to exchange the counterfeit for real USDT failed in Forta’s tests.
PancakeSwap’s developer documentation describes callbacks that run before or after actions such as swaps, with the hook and its callback permissions specified when a pool is initialized. Forta’s findings concern how particular pools used that flexibility to restrict access.
A recent trade sets the price for that trade, so reading the pool’s last price can produce an apparently stable dollar quotation without providing a usable exit for the holder.
A pool can show a dollar price without giving an ordinary holder a usable sale route.
Forta simulated outsider swaps at the midpoint of each pool’s active window. These tests cover the 32 identified pools, not every possible market or every time. The counterfeit token is separate from genuine USDT. The diagram does not quantify liquidity, fraud losses or victims.
Forta measured median prices between $0.99 and $1.005 across the 32 tokens. The rotation began Feb. 19 and continued through at least Nov. 3, with individual tokens usually maintaining their prices for two to 19 days.
One counterfeit USDC remained near its target for 80 days, so the set was broader than fake USDT alone.
On one token, a keeper made 9,522 swaps in four days. The apparent stability came from repeated permitted trading, alongside restrictions that excluded outsiders from the same pools.
One seller who contacted Forta described exchanging online-game items for a four-figure payment they believed was USDT on BNB Chain.
According to the seller’s account, their wallet showed Tether’s branding and a matching dollar balance. They discovered the token was counterfeit after sending it to an exchange and receiving no credit, and Forta traced the payment to four ordinary token Transfer events.
The examined token’s name and symbol used visually similar characters from different writing systems to resemble USDT, making the token label look familiar without identifying the genuine asset.
The acquisition cost illustrates why the displayed amount can bear little relationship to what the payer spent. Forta linked the payer in that case to a 13-wallet crew and observed one purchase in which $5 bought 215,786 counterfeit tokens.
Beyond fake USDT pools
The 32 price-maintained tokens were a subset of a much wider ecosystem. Forta identified at least 151 lookalike assets, including 115 dollar copies and copies of BTC, BNB and ETH, with 3,138,110 direct transfers recorded through Nov. 3.
Forta’s count for one older BTC copy extends only through July 2025, making the transfer total a lower bound. To estimate purchase-like payments, the researchers identified 266,497 recipient addresses that met a heuristic including receipts of 20 to 20,000 fake dollars from senders with fewer than 100 recipients.
Forta’s two payment-value estimates cover different populations:
| Token population | Estimated counterfeit-dollar payment face value | Published range |
|---|---|---|
| Dollar-token payments within the wider network of at least 151 lookalike assets | About $22 million | $11 million to $34 million |
| Subset of 32 dollar tokens maintained near $1 | About $4 million | $2 million to $7 million |
Forta says buyers, spam recipients, and test wallets can appear in the same recipient set.
Actual harm depends on what someone surrendered in return, such as the game items the seller described. The estimated face value cannot establish that amount, especially when counterfeit units can be acquired cheaply and sent in inflated quantities.
Binance’s Sept. 24 warning about fake-payment scams described counterfeit tokens with familiar names, logos, and misleading wallet values. Its example involved a thin liquidity pool followed by a sale that drained the real asset and collapsed the counterfeit’s price.
Forta’s investigation also identified that controlled pools could maintain the price while refusing outside trades.
Forta recommends checking the token contract and screening names for visually confusable characters. Binance similarly advises verifying the agreed network and full contract address before releasing goods, and checking whether a token’s apparent value can actually be realized.
For people choosing a USDT wallet, the lesson is to verify the token itself: a familiar logo and dollar balance do not make it genuine Tether.