Counterfeit USDT tokens can display dollar balances in a holder's wallet while remaining impossible to sell at that displayed value, according to a November 10 investigation by blockchain security firm Forta.
Forta identified 32 tokens whose prices were maintained near one dollar through automated trading in restricted liquidity pools on PancakeSwap. When researchers simulated selling attempts from outside wallets, all 32 tokens rejected the swaps. The price quotations came from pools that restricted trading access to whitelisted wallets only, creating a gap between displayed value and realizable value.
How the Scheme Operates
The counterfeit tokens paired with real USDT in closed pools managed by automated wallets called keepers. These keepers executed repeated small trades to maintain the pool price near one dollar, while pool restrictions prevented ordinary holders from accessing the same markets. A wallet displaying the token and its dollar balance appeared legitimate, but sellers accepting the tokens received an asset with no actual exit route.
One seller reported exchanging online-game items for what appeared to be USDT on BNB Chain. Their wallet showed Tether's branding and a matching dollar balance, but the token was counterfeit. The seller discovered this only after sending it to an exchange, which refused to credit the account. The counterfeit token's name used visually similar characters from different writing systems to resemble genuine USDT.
Scale of the Issue
Forta measured median prices between $0.99 and $1.005 across the 32 identified tokens. The price-maintenance rotation began February 19 and continued through at least November 3, with individual tokens typically holding their prices for two to 19 days. One counterfeit USDC maintained its target price for 80 days.
Beyond the 32 price-maintained tokens, Forta identified at least 151 lookalike assets, including 115 dollar copies and copies of BTC, BNB, and ETH. These tokens recorded 3,138,110 direct transfers through November 3. Forta estimated approximately $22 million in counterfeit-dollar payment face value across the wider network, with a range of $11 million to $34 million. The subset of 32 dollar tokens maintained near one dollar accounted for an estimated $4 million, ranging from $2 million to $7 million.
Protection Measures
Forta recommends verifying token contracts and checking names for visually confusing characters before accepting cryptocurrency payments. The firm advises confirming the correct network and full contract address before transferring goods or assets. Binance similarly warned in September about fake-payment scams involving counterfeit tokens with familiar names and logos paired with misleading wallet values.
