Your wallet may show a dollar balance for fake USDT that you cannot sell

Fake USDT could show a convincing dollar balance in a wallet while its holder was unable to sell it through the market supplying that price, according to a Nov. 10 investigation by blockchain security firm Forta.

The researchers identified 32 tokens whose prices were maintained in successive periods by wallets repeatedly trading through restricted pools. When Forta simulated an outside wallet trying to sell at the midpoint of each pool's active window, all 32 rejected the swap.

That left a gap between the dollar value a wallet could display and the value an ordinary holder could obtain through the identified market. A familiar token name, a completed transfer and a convincing balance could all appear together for a seller accepting crypto without delivering the genuine asset.

The price came from a closed market

Forta traced the pricing mechanism to PancakeSwap Infinity pools pairing counterfeit tokens with real USDT. Automated wallets, which the researchers call keepers, repeatedly made small round-trip trades to keep the latest pool price near a dollar.

The pools' swap hooks restricted trading to wallets on the operators' allowlists. The keepers could maintain the quotation while an outside holder's attempt to exchange the counterfeit for real USDT failed in Forta's tests.

PancakeSwap's developer documentation describes callbacks that run before or after actions such as swaps, with the hook and its callback permissions specified when a pool is initialized. Forta's findings concern how particular pools used that flexibility to restrict access.

A recent trade sets the price for that trade, so reading the pool's last price can produce an apparently stable dollar quotation without providing a usable exit for the holder.

A pool can show a dollar price without giving an ordinary holder a usable sale route.

Forta simulated outsider swaps at the midpoint of each pool's active window. These tests cover the 32 identified pools, not every possible market or every time. The counterfeit token is separate from genuine USDT. The diagram does not quantify liquidity, fraud losses or victims.

Sources and evidence

Sources

1. Forta, Nov. 10, 2026

Supporting facts

• According to Forta, each of the 32 tokens traded in a PancakeSwap Infinity pool whose swap hook admitted only operator-allowlisted wallets; simulated outsider swaps were refused in all 32 pools at the midpoint of each pool's active window. [1]
• Forta says keeper wallets repeatedly round-tripped small trades between counterfeit tokens and real USDT, maintaining recent pool prices that wallets or price feeds reading those pools could display near $1. [1]
• Forta published its counterfeit-dollar investigation on Nov. 10, 2026, reporting 32 counterfeit dollar tokens on BNB Chain whose prices were maintained near $1 in successive active windows. [1]

Method

Schematic of reported pool roles, not a liquidity or monetary scale. Solid paired arrows show keeper round trips; the dashed attempted outsider sale stops at the allowlist gate. The quote readout represents a wallet or feed reading that pool, not a proven feed used by the seller in the case.

Scope

Forta simulated outsider swaps at the midpoint of each pool's active window. These tests cover the 32 identified pools, not every possible market or every time. The counterfeit token is separate from genuine USDT. The diagram does not quantify liquidity, fraud losses or victims.

Infographic by CryptoSlate

Forta measured median prices between $0.99 and $1.005 across the 32 tokens. The rotation began Feb. 19 and continued through at least Nov. 3, with individual tokens usually maintaining their prices for two to 19 days.

One counterfeit USDC remained near its target for 80 days, so the set was broader than fake USDT alone.

On one token, a keeper made 9,522 swaps in four days. The apparent stability came from repeated permitted trading, alongside restrictions that excluded outsiders from the same pools.

One seller who contacted Forta described exchanging online-game items for a four-figure payment they believed was USDT on BNB Chain.

According to the seller's account, their wallet showed Tether's branding and a matching dollar balance. They discovered the token was counterfeit after sending it to an exchange and receiving no credit, and Forta traced the payment to four ordinary token Transfer events.

The examined token's name and symbol used visually similar characters from different writing systems to resemble USDT, making the token label look familiar without identifying the genuine asset.

The acquisition cost illustrates why the displayed amount can bear little relationship to what the payer spent. Forta linked the payer in that case to a 13-wallet crew and observed one purchase in which $5 bought 215,786 counterfeit tokens.

Beyond fake USDT pools

The 32 price-maintained tokens were a subset of a much wider ecosystem. Forta identified at least 151 lookalike assets, including 115 dollar copies and copies of BTC, BNB and ETH, with 3,138,110 direct transfers recorded through Nov. 3.

Forta's count for one older BTC copy extends only through July 2025, making the transfer total a lower bound. To estimate purchase-like payments, the researchers identified 266,497 recipient addresses that met a heuristic including receipts of 20 to 20,000 fake dollars from senders with fewer than 100 recipients.

Forta's two payment-value estimates cover different populations:

Forta says buyers, spam recipients, and test wallets can appear in the same recipient set.

Actual harm depends on what someone surrendered in return, such as the game items the seller described. The estimated face value cannot establish that amount, especially when counterfeit units can be acquired cheaply and sent in inflated quantities.

Binance's Sept. 24 warning about fake-payment scams described counterfeit tokens with familiar names, logos, and misleading wallet values. Its example involved a thin liquidity pool followed by a sale that drained the real asset and collapsed the counterfeit's price.

Forta's investigation also identified that controlled pools could maintain the price while refusing outside trades.

Forta recommends checking the token contract and screening names for visually confusable characters. Binance similarly advises verifying the agreed network and full contract address before releasing goods, and checking whether a token's apparent value can actually be realized.

For people choosing a USDT wallet, the lesson is to verify the token itself: a familiar logo and dollar balance do not make it genuine Tether.