Fake Dollars Kept at $1: A Counterfeit "USDT" Economy on BNB Chain

Since February 2026, a set of keeper wallets on BNB Chain has held 32 counterfeit dollar tokens at about $1, one after another. Each token trades in a PancakeSwap Infinity pool whose swap hook accepts trades only from wallets on the operators' allowlist. The keepers set the last price, and in our simulations an outside wallet could not sell a fake dollar back for real USDT. A wallet or price feed that reads the pool shows the fake at about $1.

Those 32 belong to at least 151 lookalike tokens that carried 3,138,110 direct transfers by 3 November. Of the addresses that received them, 266,497 got what looks like a payment for a purchase: 20 to 20,000 fake dollars from a sender who paid few other addresses. We estimate that about 37,000 of those receivers have at some point sent real funds to a major exchange, which suggests a real user behind the address. Together they received roughly $22 million in fake dollars, counted at the $1 their wallets displayed. Not every one is a victim, and the real loss is what each seller handed over in return.

One seller who contacted us shows how it plays out. They told us they sold items from an online game for a four-figure sum in "USDT" on BNB Chain, and that the wallet showed Tether's name, logo and the matching dollar value. By their account, when they deposited it at an exchange, nothing was credited, and that is how they learned the token was fake. The token was one of the 32.

Binance described this method in Fake Payment Scams Explained, published on the Binance Blog on 24 September 2026 and covered by Korean press on 27 October (DigitalToday, SBS Biz). The post explains the method in general terms and names no tokens or addresses. We traced this payment onchain, from the token to the market that keeps it looking real.

How the counterfeit works

An honest ERC-20 with a lying name. The token has no hidden balance write and no extra mint. The balance came from four ordinary Transfer events from the payer, adding up to the agreed price, and the seller then forwarded it all.

A mixed-script name. The symbol and name read "USDT" and "Tether USD". Several of their letters come from other alphabets, and one is a Roman numeral that renders like a Latin letter. Unicode NFKC normalisation folds only the numeral. The confusables table in Unicode UTS #39 maps the rest to their Latin lookalikes, so a skeleton check catches it. Other fakes in the same wallets go further, hiding zero-width characters inside the symbol and mixing in letters from more scripts.

A launchpad template. The fake token is a 45-byte EIP-1167 minimal proxy: it holds no logic of its own and forwards every call to TokenV2, the Flap launchpad's standard token implementation (listed in Flap's docs). Each fake dollar we checked in the rotation is a clone of it. The implementation's own storage also holds the plain name "Tether USD" and symbol "USDT", so BscScan shows the template itself as a Tether lookalike. The fake token's image is the Tether logo, and its "8888" address suffix is Flap's vanity pattern.

Zero-gas transactions. Neither side needed any BNB. Every transfer in this case, the four payments and the seller's move to the exchange, went out at a gas price of zero. Right behind each one, in the same block, a gas-sponsorship wallet sent a transaction of its own priced to cover both, the bundle that BNB Chain's gasless standard (BEP-414) describes. Each cost the sponsor a fraction of a cent. The same pool of sponsor wallets paid for both sides, so the chain does not show whose account was billed.

A pool pinned at $1. A PancakeSwap pool pairs the fake with real USDT, and a keeper wallet round-trips small trades through it every few minutes, so the last price stays near $1.

Where our findings go further

At the crew's purchase prices, the whole payment to the seller cost one to two cents. A pool kept at $1 can price the next payment too.

Who keeps the price, and who pays with it

• Keepers. The keepers held the 32 fake dollars at medians between 0.99 and 1.005. Each token usually held its price for 2 to 19 days before the next took over, from 19 February through at least 3 November 2026; one fake USDC stayed pinned for 80 days. On one token the keeper made 9,522 swaps in four days. The swap hook is what holds the price: simulated at the middle of each pool's active window, an outside wallet was refused in all 32 pools.
  ‍
• Retail crews. The payer belongs to a 13-wallet crew, active since August 2025, that buys cheap fake tokens and pays out in chunks. In one purchase, $5 bought 215,786 of them. Onchain the crew earns almost nothing: from August 2025 to November 2026 it took in 11,368.46 real dollars and sent out 11,054.12, and 1.854 BNB in against 1.82 out. Its gain, if any, is the goods, which leave no onchain record.

How large it is

Counting every lookalike token we could tie to this ecosystem: at least 151 fake tokens, 115 of them dollar copies and the rest BTC, BNB or ETH copies, 136 made on Flap. Together they carried 3,138,110 direct transfers from 518,417 sender addresses. The top 10 senders account for 24.0% of those transfers, the top 100 for 31.4% and the top 1,000 for 39.0%. One 2021 BTC copy was too large to download in full and is counted only to July 2025, so these totals are a lower bound.

The traffic grew with the $1 rotation. It ran at about 28,000 to 52,000 transfers a month from August 2025 to February 2026, when the first keeper started, then climbed from March to a peak of 814,457 in August.

‍

We narrowed the receivers down to those that look paid for a purchase:

For those 137 we added up the fake dollars each received, at $1 each; the median was 51. Scaled to all 266,497, that gives the $22 million above, somewhere between $11 million and $34 million. Counting only the 32 tokens held near $1, it is about $4 million ($2 million to $7 million).

None of these figures counts victims: buyers, spam recipients and test wallets sit in the same set. Face value is not loss either. Fake tokens cost about a thousandth of a cent each, so amounts are free to inflate: after removing airdrop-style sprays, the median receiver got about 26 fake dollars, and 178,059 addresses got at least 1,000.

Three public reports, verified onchain

People have reported tokens from the same rotation on Chainabuse. We matched each report to its transaction:

• 30 July 2026: seven Telegram collectible Gifts, agreed at $600. The report describes a buyer who sent a counterfeit "USDT". The transfer delivered 650 fake tokens at 12:00:38 UTC that day.
• 3 September 2026: "sent 500 USDT". The report describes a contact who claimed to have paid 500 USDT. The transfer delivered 500 fake tokens on 2 September at 21:18 UTC.
• August 2026: an investment-scam report. The reporter writes that 13,102.81 real USDT was taken from their wallet. Onchain, it left at 17:08:30 UTC on 1 June, and 13,201 fake tokens arrived 65 seconds later.

We found no link between the senders in these reports and the crew in our case.

"All that glisters is not gold." William Shakespeare, The Merchant of Venice

What defenders can check

The method works on any chain where anyone can launch a token and a pool. Three checks help.

• Check the contract address. Real USDT on BNB Chain, Tether USD, is 0x55d3…7955.
• Run a UTS #39 confusables skeleton on token names and symbols, and flag any non-ASCII string whose skeleton matches a protected ticker.
• Price a token by what it can be sold for. A last trade at $1 tells you only what the last trade was.

A token's name is a label anyone can type; only its contract address says what you were paid. Forta alerts when a new token impersonates an asset and when a pool is set up to price it. Request a demo to see impersonation alerts for the assets you issue or accept.