Watch Out! Fake USDT!

If you try searching online whether cryptocurrency can be forged, the most popular search engines will give you a clear answer: NO.

“Blockchain records containing information about asset ownership cannot be falsified.”

Today we will show that, in practice, things are not always so simple. In this article, we will explain how fake cryptocurrency tokens can be created, how scammers use them, and how they profit from unsuspecting victims.

To help illustrate the issue, we will share a real case that happened to one of our clients.

The Story

A client came to our exchange office requesting to withdraw a large amount of funds held in his wallet. The funds were stored in a Trust Wallet wallet and amounted to 34,967.14 USDT on the BEP20 network.

As usual, we provided our USDT BEP20 deposit address: 0x33367cf….723653. After the client successfully sent a test transaction of 50 USDT, we waited for the funds to arrive.

However, neither after 10 minutes nor after 30 minutes did the funds appear in our wallet, even though the USDT had been deducted from the client’s balance.

After checking the transaction on the blockchain, we confirmed that its status was “Success,” meaning the transfer had been completed and the tokens had successfully reached our address. The destination address was correct. Yet our balance remained unchanged.

We also verified that the client was using the genuine Trust Wallet application. We had previously encountered situations where users downloaded fake wallet applications through phishing links, but in this case the wallet was authentic. We also asked whether anyone else had access to the wallet or the seed phrase. The client confidently stated that he had never shared it with anyone. That possibility was ruled out as well.So what was the problem?

We asked the client to return to the wallet’s main screen and view the total portfolio balance. At that moment, everything became clear.

There was no longer any doubt.

The client was holding fake USDT.

Fake USDT: How to Identify It

In the example above, there are two transactions: one involving fake USDT and another involving genuine USDT.

1️⃣Check the Smart Contract Address

The original USDT, created by Tether Limited, is managed by the Hong Kong-based financial conglomerate iFinex Inc., which is also the parent company of the cryptocurrency exchange Bitfinex. USDT is backed by reserves of currency and securities held by Tether Limited. The total value of reserves in dollar equivalent is equal to the total amount of all issued USDT. In simple terms, Tether Limited reserves 1 USD in its accounts (in currency, securities, etc.) for each 1 USDT issued; therefore, 1 USDT = 1 USD.

To monitor USDT backing, quarterly audits are conducted by independent auditors, and reports are published on their official website.

According to the latest report as of 31.05.2023, the reserve assets of Tether Limited are distributed as follows:
84.7% - Cash & Cash Equivalents & Other Short-Term Deposits (of which 76.53% U.S. Treasury Bills)
0.17% Corporate Bonds
4.14% Precious Metals
1.83% Bitcoin
2.61% Other Investments
6.54% Secured Loans (None To Affiliated Entities)

Unlike other cryptocurrencies, Tether does not have its own blockchain; instead, it operates on other cryptocurrency blockchains through smart contracts.

Currently, USDT operates on many blockchains, including Bitcoin, Ethereum, Avalanche, Polygon, Tron, EOS, etc.

In our example, we are using the USDT token on the BEP20 network. This is USDT created through a smart contract by the Binance Chain ecosystem, and this network is an Ethereum-compatible chain. All transfers and other operations within the network are carried out via the Binance Smart Chain (BEP20 token). We will not go into technical details of token creation via smart contracts; we will only note that each time a new token is created on a specific blockchain, a smart contract is issued for it, and it is immutable.

Who can create a token on a smart contract? – anyone can. And according to the guide published on the official Binance website, the process of creating a token on the BEP20 network does not require any special programming knowledge; it can take just a few minutes.

You can name your token CryptoInvest, you can name it David, or even Tether as our scammer did, and you can also keep the token abbreviation as USDT, like the “original.” This is not prohibited. You can also specify any number of tokens you wish to issue, even a billion. And within a few minutes, you become the owner of a billion USDT on the BEP20 network. However, this billion has no dollar value because it is not backed by any assets, money, or shares, as the “original” USDT is. Your token is not traded on any exchange; it is not needed by anyone — it is a “fake” token.

As mentioned, each time a new token is created, the blockchain generates a smart contract for that token; it is recorded on the blockchain and cannot be changed.

The smart contract of the “original” tokens is unique and publicly known.

Below we will list the smart contracts of the “original” USDT on different networks. Please memorize them.

• USDT TRC20 (Tron):
  TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
• USDT BEP20 (Binance Smart Chain):
  0x55d398326f99059ff775485246999027b3197955
•  USDT ERC20 (Ethereum):
  0xdac17f958d2ee523a2206206994597c13d831ec7
• USDT Polygon:
  0xc2132D05D31c914a87C6611C10748AEb04B58e8F
•  USDT Solana:
  Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB

All smart contract addresses can be viewed, for example, on CoinMarketCap in the “More” dropdown menu

They can also be seen in cold wallets. For example, in SafePal, the smart contract can be found here:

Unfortunately, we were unable to find where Trust Wallet displays a token’s smart contract address. It appears that scammers are aware of this limitation and actively exploit it. In our experience, Trust Wallet is frequently used in schemes involving counterfeit tokens.

2️⃣ What else should you pay attention to when receiving funds?

Pay attention to the dollar equivalent of the amount received.As you can see in the screenshot above, in the case of fake USDT, the blockchain did not display the dollar equivalent of the tokens: For 50 Tether USDT. However, in the case of the “original” tokens, the blockchain displayed the equivalent value: For 10,000 ($10,010).This is because the first token is essentially worthless, while the second is the genuine token.

How did the entire scam work?

As our client explained, he invested money in an investment project that promised high returns in cryptocurrency. The profits from the project were sent to his Trust Wallet cold wallet. He was instructed to download the wallet onto his phone, and after some time, funds did indeed start appearing in the wallet.After becoming convinced that the investment project was paying out, he invested additional funds in order to earn a higher return.

After waiting until a substantial amount had accumulated in the wallet, he attempted to transfer the funds to his Binance account. The transaction was sent successfully, but the funds never arrived on the exchange.

He reported the issue to the investment company, and they responded that the funds were not entirely “clean.”Indeed, later that same day, he received an email supposedly from Binance stating that his funds could not be credited to his account. The email claimed that, in order to receive the funds, he needed to pay a 30% fee to “clean” the money through a mixer service.The email also contained instructions telling him to purchase approximately $10,000 worth of cryptocurrency through Binance P2P and send it to a specified wallet address.

The wallet address was included in the email.He followed these instructions.It is not difficult to guess that the email supposedly sent by Binance was also created by the same scammers, and the wallet address provided in the email belonged to them as well.

Suspecting that something was wrong, the client came to our exchange office, where we were able to analyze the situation and determine what had happened.In total, the victim lost more than $40,000.Unfortunately, in cases like this, the funds are usually lost permanently, and identifying the scammers is virtually impossible.By publishing this article, we hope to help others recognize similar schemes and avoid losing their money.

How to Protect Yourself

1. Whenever you receive cryptocurrency, check your wallet’s total balance. If genuine funds have arrived, the total balance displayed in USD, EUR, AMD, or another fiat currency should increase accordingly.
2. If you know how to inspect transactions on a blockchain explorer, verify the token’s smart contract address against the official USDT contract addresses listed above.
3.  Binance does not communicate with customers through email regarding fund transfers and will never ask you to send money. Emails from Binance are automated notifications only. Communication with Binance support representatives takes place through the internal support system within your account. Any suspicious communication can be verified through Binance’s official verification service
4. Be extremely cautious of projects promising high and stable returns. No company—especially one involved in trading, mining, or cryptocurrency-related activities—can guarantee stable profits. The cryptocurrency market is inherently volatile. Any company promising even a stable 10% return should be treated with skepticism.

Social media platforms are currently flooded with advertisements for high-yield investment schemes. You have probably seen fake advertisements impersonating banks or major corporations and promising extraordinary passive income. In most cases, these are fraudulent schemes designed to steal your money.

Stay vigilant and protect your funds.

If you need a safe and reliable cryptocurrency exchange service in Armenia, feel free to contact us. We know what we are doing.