Fake USDT could show a convincing dollar balance in a wallet while its holder was unable to sell it through the market supplying that price, according to a Nov. 10 investigation by blockchain security firm Forta.
Related Asset Tether USDT · Stablecoin
The researchers identified 32 tokens whose prices were maintained in successive periods by wallets repeatedly trading through restricted pools. When Forta simulated an outside wallet trying to sell at the midpoint of each pool's active window, all 32 rejected the swap.
That left a gap between the dollar value a wallet could display and the value an ordinary holder could obtain through the identified market. A familiar token name, a completed transfer and a convincing balance could all appear together for a seller accepting crypto without delivering the genuine asset.
The price came from a closed market
Forta traced the pricing mechanism to PancakeSwap Infinity pools pairing counterfeit tokens with real USDT. Automated wallets, which the researchers call keepers, repeatedly made small round-trip trades to keep the latest pool price near a dollar.
The pools' swap hooks restricted trading to wallets on the operators' allowlists. The keepers could maintain the quotation while an outside holder's attempt to exchange the counterfeit for real USDT failed in Forta's tests.
PancakeSwap's developer documentation describes callbacks that run before or after actions such as swaps, with the hook and its callback permissions specified when a pool is initialized. Forta's findings concern how particular pools used that flexibility to restrict access.
A recent trade sets the price for that trade, so reading the pool's last price can produce an apparently stable dollar quotation without providing a usable exit for the holder.
A $1 quote behind a restricted exit
Keeper trades supplied convincing prices while outsider sales failed in Forta's simulations of all 32 identified pools.
Keeper access and outsider rejection in Forta's identified poolsKeeper round-trip trades maintain a near-dollar pool price. A separate outsider sale attempt stops at an allowlist gate. A reader of the pool quote may display about one dollar.RESTRICTED POOLCounterfeit token+ real USDTAllowlist controls swapsKeeper walletOn the allowlist
Small round-trip trades
POOL QUOTE≈ $1May appear in walletsOutside walletNot on the allowlist
32 / 32 poolsRejected outsider swaps in Forta's testsSampled at each active window's midpoint
A price display without an accessible sale routeKeeper trades enter the restricted pool. An outsider swap attempt stops at the gate. The pool still supplies a near-dollar price to readers.Keeper walletAllowlistedOutside walletNot allowlisted
Round trips
RefusedRESTRICTED POOLCounterfeit token+ real USDTAccess controlled
POOL QUOTE≈ $1May appear in wallets32 / 32 pools refused outsider swapsForta's active-window midpoint tests
A pool can show a dollar price without giving an ordinary holder a usable sale route.
Forta simulated outsider swaps at the midpoint of each pool's active window. These tests cover the 32 identified pools, not every possible market or every time. The counterfeit token is separate from genuine USDT. The diagram does not quantify liquidity, fraud losses or victims.
Sources and evidence
Sources
- Forta, Nov. 10, 2026
- According to Forta, each of the 32 tokens traded in a PancakeSwap Infinity pool whose swap hook admitted only operator-allowlisted wallets; simulated outsider swaps were refused in all 32 pools at the midpoint of each pool's active window. [1]
- Forta says keeper wallets repeatedly round-tripped small trades between counterfeit tokens and real USDT, maintaining recent pool prices that wallets or price feeds reading those pools could display near $1. [1]
- Forta published its counterfeit-dollar investigation on Nov. 10, 2026, reporting 32 counterfeit dollar tokens on BNB Chain whose prices were maintained near $1 in successive active windows. [1]
Supporting facts
Method
Schematic of reported pool roles, not a liquidity or monetary scale. Solid paired arrows show keeper round trips; the dashed attempted outsider sale stops at the allowlist gate. The quote readout represents a wallet or feed reading that pool, not a proven feed used by the seller in the case.
Scope
Forta simulated outsider swaps at the midpoint of each pool's active window. These tests cover the 32 identified pools, not every possible market or every time. The counterfeit token is separate from genuine USDT. The diagram does not quantify liquidity, fraud losses or victims.
Infographic by CryptoSlate
Forta measured median prices between $0.99 and $1.005 across the 32 tokens. The rotation began Feb. 19 and continued through at least Nov. 3, with individual tokens usually maintaining their prices for two to 19 days.
One counterfeit USDC remained near its target for 80 days, so the set was broader than fake USDT alone.
Related Asset USDC USDC · Stablecoin
On one token, a keeper made 9,522 swaps in four days. The apparent stability came from repeated permitted trading, alongside restrictions that excluded outsiders from the same pools.
One seller who contacted Forta described exchanging online-game items for a four-figure payment they believed was USDT on BNB Chain.
Related Asset BNB BNB · $585.65 24-hour change: down 8.08%
According to the seller's account, their wallet showed Tether's branding and a matching dollar balance. They discovered the token was counterfeit after sending it to an exchange and receiving no credit, and Forta traced the payment to four ordinary token Transfer events.
The examined token's name and symbol used visually similar characters from different writing systems to resemble USDT, making the token label look familiar without identifying the genuine asset.
The acquisition cost illustrates why the displayed amount can bear little relationship to what the payer spent. Forta linked the payer in that case to a 13-wallet crew and observed one purchase in which $5 bought 215,786 counterfeit tokens.
Beyond fake USDT pools
The 32 price-maintained tokens were a subset of a much wider ecosystem. Forta identified at least 151 lookalike assets, including 115 dollar copies and copies of BTC, BNB and ETH, with 3,138,110 direct transfers recorded through Nov. 3.
Related Asset Bitcoin BTC · $65,414.97 24-hour change: down 4.99%
Forta's count for one older BTC copy extends only through July 2025, making the transfer total a lower bound. To estimate purchase-like payments, the researchers identified 266,497 recipient addresses that met a heuristic including receipts of 20 to 20,000 fake dollars from senders with fewer than 100 recipients.
Forta's two payment-value estimates cover different populations:
| Token population | Estimated counterfeit-dollar payment face value | Published range |
|---|---|---|
| Dollar-token payments within the wider network of at least 151 lookalike assets | About $22 million | $11 million to $34 million |
| Subset of 32 dollar tokens maintained near $1 | About $4 million | $2 million to $7 million |
Forta says buyers, spam recipients, and test wallets can appear in the same recipient set.
Actual harm depends on what someone surrendered in return, such as the game items the seller described. The estimated face value cannot establish that amount, especially when counterfeit units can be acquired cheaply and sent in inflated quantities.
Binance's Sept. 24 warning about fake-payment scams described counterfeit tokens with familiar names, logos, and misleading wallet values. Its example involved a thin liquidity pool followed by a sale that drained the real asset and collapsed the counterfeit's price.
Related Company Binance Global crypto exchange
Forta's investigation also identified that controlled pools could maintain the price while refusing outside trades.
Forta recommends checking the token contract and screening names for visually confusable characters. Binance similarly advises verifying the agreed network and full contract address before releasing goods, and checking whether a token's apparent value can actually be realized.
For people choosing a USDT wallet, the lesson is to verify the token itself: a familiar logo and dollar balance do not make it genuine Tether.