Fake Tokens, Honeypots & Rug Pulls
The balance is real on screen and fictional on-chain. Honeypots, flash USDT and exit rugs.
A fake token is a user-interface attack. Wallets render whatever a contract claims, so a scammer only needs to make the number look right for long enough to close a deal — the sell function is where the truth lives.
The variants below span cloned stablecoins, contracts that permit buys and block sells, supply that vanishes on a timer, and liquidity that leaves in one block. All of them are checkable before you pay, and each investigation shows exactly where to look.
Documented cases in detail
The wholesale end of fake-token fraud is documented in the fake EURC bulk sale scam offering 20M unissued stablecoins at $15K per million — a contract that never existed in Circle's registry.
Not every token loss comes from a scammer talking to you: how MEV sandwich bots skim retail swaps purely by front-running swaps on Base and Arbitrum.
The token that looks like Tether and settles like nothing is taken apart in our Flash USDT scam investigation, with the contract address that exposes the fake balance and the 10-second check to run before any trade.
How it works
The display trick
Name, ticker and decimals are free text. USDT-Z, HKDAP, a mirrored logo — the wallet has no opinion on authenticity.
The asymmetric contract
Buys succeed, sells revert for anyone outside a whitelist. Blacklists, transfer taxes and pausable transfers do the same job.
The exit
Liquidity is pulled, ownership is renounced after a hidden mint, or the deployer bridges out. The chart goes vertical, then to zero.
Investigations in this vector
USDT Flasher Free Download: What the File Really Does
Free USDT flasher downloads promise fake Tether and deliver wallet stealers. What the installer touches and how to check your wallet after running one.
Read the investigationFake Gold-Backed Tokens: One Tonne, Half a Million Coins
Digital bullion projects sell an ounce per token and never buy a bar. Check the tonne-versus-supply arithmetic, the LBMA refiner list and the mint key.
Read the investigationUSDT Flasher Software: The $500 Tool That Robs Its Buyers
Flash USDT software and free-download flashers never mint spendable Tether. The demo sends an impostor token; the installer often steals wallets.
Read the investigationCodexField $85M Rug Pull: Site and X Gone in 48 Hours
CodexField raised $85M on BNB Chain, then wiped its site and X within 48 hours. The timeline, the wallet trail and the warning signs it ignored.
Read the investigationFlash USDT Scam: Spot Fake USDT in 10 Seconds
Flash USDT is fake USDT: a balance you can see and never sell. Check the real Tether contract in 10 seconds, and what to do if you already paid.
Read the investigationFake HSBC & HKDAP Stablecoins: HK License Window Hit
April 2026: 18 days after HKMA issued Hong Kong's first stablecoin licenses to HSBC & Anchorpoint, fake HSBC/HKDAP tokens hit.
Read the investigationMEV Sandwich Bots: How They Skim Your Swaps
Sandwich attacks cost Ethereum users close to $40M in 2025, per EigenPhi data. How MEV bots skim swaps and 5 habits that defeat them.
Read the investigationFake EURC Bulk Sale: $15K-per-Million Wholesale Trap
20M fake EURC on BNB Chain. Tiered pricing $15K/$12K/$10K per million. Circle never issued this token — the contract isn't in their registry.
Read the investigationIs USDT.z a Scam? The BSC Honeypot Explained [2026]
USDT.Z is not Tether. The BSC contract lets you buy but blocks every sell, then a bot takes your gas BNB. Run the 30-second honeypot test first.
Read the investigationRed flags
- The contract address does not match the issuer's official one, character for character.
- Nobody except a handful of addresses has ever successfully sold.
- The deployer holds a mint, pause, blacklist or fee-setting function.
- Liquidity is unlocked, or the lock expires within weeks.
- The deal happens in a private chat with a countdown attached.
If it already happened
- 1.Stop trying to sell — a honeypot's sell attempts only pay gas to the attacker's design.
- 2.Record the contract address and the deployer; both feed public scam databases.
- 3.If a counterparty pushed the token during an OTC deal, treat every other asset in that deal as suspect.
- 4.Report the contract to the explorer — labelled contracts stop the next buyer.
Related vocabulary
Got a suspicious message, link or token?
Paste it into the free detector. No signup, no cost, answer in seconds.