Fake USDT With Real-Looking Dollar Balances Traced to Gated PancakeSwap Pools

Blockchain security firm Forta has traced a counterfeit-USDT scheme to 32 fake tokens on BNB Chain whose wallets displayed stable dollar balances that holders could not actually sell. The pricing came from closed PancakeSwap Infinity pools, where allowlisted "keeper" wallets kept prices pinned near $1 while outside trades failed.

Forta's tests found that attempts to swap the counterfeit tokens for genuine USDT were rejected by the pools' swap hooks. The researchers detailed the mechanism in their investigation, published with data running through Nov. 3.

How the fake dollar price worked

Forta traced the pricing to PancakeSwap Infinity pools pairing counterfeit tokens with real USDT. Automated keeper wallets made small round-trip trades to keep the pool's latest price near a dollar.

The catch sat in the hooks. PancakeSwap's developer documentation describes callbacks that run before or after swaps, with hook permissions set when a pool initializes. Here, the pools restricted trading to operator-approved allowlists.

A recent trade sets the price for that trade. So reading the pool's last price produces an apparently stable dollar quotation without giving an outside holder a usable exit. Forta measured median prices between $0.99 and $1.005 across the 32 tokens.

The rotation began Feb. 19 and ran through at least Nov. 3. Individual tokens typically held their price for two to 19 days. One counterfeit USDC stayed near target for 80 days, so the scheme reached beyond fake Tether.

On one token, a keeper executed 9,522 swaps in four days. Stability came from repeated permitted trading combined with restrictions that excluded everyone else.

What did one victim actually lose?

One seller who contacted Forta described exchanging online-game items for what they believed was a four-figure USDT payment on BNB Chain. Their wallet showed Tether's branding and a matching dollar balance.

They discovered the token was fake after sending it to an exchange and receiving no credit. Forta traced the payment to four ordinary token Transfer events. The token's name and symbol used visually similar characters from different writing systems to mimic USDT's label.

The economics are stark. Forta linked the payer to a 13-wallet crew and observed one purchase in which $5 bought 215,786 counterfeit tokens. The displayed balance can bear no relationship to what the payer spent.

The ecosystem is far wider than fake USDT

The 32 price-maintained tokens were a subset of a much larger set. Forta identified at least 151 lookalike assets, including:

• 115 dollar-denominated copies, plus copies of BTC, BNB and ETH;
• 3,138,110 direct transfers recorded through Nov. 3;
• 266,497 recipient addresses matching a purchase heuristic of 20 to 20,000 fake dollars from senders with fewer than 100 recipients.

The transfer count is a lower bound — one older BTC copy's tally only runs through July 2025. Forta cautions that buyers, spam recipients and test wallets can appear in the same recipient set, and actual harm depends on what victims surrendered in return.

Binance issued its own warning on Sept. 24 about fake-payment scams. It described counterfeit tokens with familiar names, logos and misleading wallet values, and gave an example involving a thin liquidity pool followed by a sale that drained the real asset and collapsed the counterfeit's price. Forta's finding adds a second mechanism: controlled pools that maintain the price while refusing outside trades entirely.

What should holders check before trusting a balance?

Forta recommends verifying the token contract and screening names for visually confusable characters. Binance advises confirming the agreed network and the full contract address before releasing goods, and testing whether an apparent token value can actually be realized.

The practical lesson for anyone choosing a USDT wallet is simple. A familiar logo and a dollar balance do not make the asset genuine Tether. As keeper-driven price maintenance spreads beyond USDT copies, on-chain verification of contract addresses is likely to become a baseline step for peer-to-peer payments settling in dollar tokens.