Fake USDT: how to check a token's contract address

Whether USDT is genuine comes down to one string — the token's contract address. The name “Tether USD” and the ticker USDT in a wallet are written by whoever deployed the contract: they are ordinary fields, and the network does not check them. Open the token's properties in your wallet, copy the contract address and compare it with the reference one in full — not by the first and last characters.

The reference for TRON is TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t, and for Ethereum 0xdAC17F958D2ee523a2206206994597C13D831ec7. Both addresses are published by the issuer itself on its page of supported protocols; the page was checked on 19.09.2026. In TRON the letter case matters, in Ethereum it does not: the same string in lower case means the same address.

For BNB Smart Chain there is no reference from the issuer at all: a USDT address for this network is simply absent from its page — verified 19.09.2026. What this network calls USDT was not issued by Tether, so the address has to be checked not against the issuer's page but against the explorer's label and against the address given by the party receiving the transfer.

Why the name cannot be trusted and the address can

The name and the ticker are the fields name() and symbol() inside the contract. Their value is written by whoever deployed the contract; the network does not check those values and cannot check them. The only identifier a token has is the contract address at which it lives on the network.

That this is not theory shows up in a plain search. In the Ethereum explorer, the string “USDT” returns, among the first 50 results, at least thirty contracts whose ticker is exactly USDT, and only one of them is the real one (measured 19.09.2026). There is no complete count: paging through the search returns an error, so thirty is a lower bound, not a total.

In twenty-nine of the fakes examined, what has been copied is precisely what people usually look at: the number of decimal places — six in every one of them, as in the real token; in most of them the name “Tether USD” and a supply of 80–85 billion, snapshots of the real supply on various dates (the same sample, 19.09.2026). Neither the name, nor the number of decimals, nor the supply figure is a sign of anything.

Two reference addresses — and the network where there is no reference

Strings have to be compared in full. A wallet and an explorer show an address in shortened form — the first and last characters, the middle hidden — and in that form two different addresses look identical. So check the whole string, character by character.

On Ethereum and TRON the reference address is published by the issuer itself. For BNB Smart Chain the issuer publishes no USDT address at all: what this network calls USDT is a wrapped token, and Tether did not issue it. It has to be checked not against Tether's page but against the explorer's label and against the address given by the party receiving the transfer.

Let us say it plainly: the main method of checking, the one this whole article rests on, does not apply on this network — there is nothing to compare the address with. The explorer's label, which calls this contract a wrapped token rather than Tether USD, and the address from the party receiving the transfer are weaker supports than a reference. Why the issuer publishes no address is not explained on its site, and we are not going to guess.

How to open a contract's page on this network and what to look at there is covered separately — checking a transfer on BNB Chain.

A detail that saves you a mistake: the real USDT on Ethereum and TRON has six decimal places, while the mass-market “USDT” on BNB Chain has eighteen (direct calls to nodes, 19.09.2026). That is a difference between contracts, not a sign of a fake, but an amount is written differently in the two networks.

What to look at in the explorer

The signs are listed in descending order of reliability. Only the first one cannot be faked; the rest are auxiliary, and on its own none of them proves anything.

• The address matches the reference. The one sign that cannot be copied: the address is the token.
• The source code is verified. In all 29 of the fakes examined on Ethereum the code is not verified (19.09.2026).
• The explorer knows the token's price. The real one has a price; in the fakes from the same sample the price field is empty.
• The label and the reputation. A weak sign: by default every token's reputation is “unknown”, and the explorer itself writes that the ratings may be inaccurate, because they are built on subjective assessments and community reports.

A separate matter is the masking of the name. Since 29.07.2024 the explorer hides the names of suspicious tokens behind ERC20 *** and warns in the same breath that honest tokens can end up behind the mask too (the explorer's help pages, captured 19.09.2026). The mask is a reason to leave the token alone; its absence means nothing.

In TRON the page of the genuine contract looks like this: a “verified” mark, a filled-in home page and technical description, empty warning labels, over seventy-six million holders (measured 19.09.2026). For BNB Chain we did not measure the “code verified” and “price known” signs: the explorer of that network blocks automated requests, and presenting them as verified would be dishonest.

How the fake got into the wallet

You did not add it — it was sent to you. A wallet shows a token for one of two reasons: it is in the built-in list, or the wallet spotted it in your transfers by itself. In the second case nobody is answerable for its authenticity.

The line “USDT” in the list of assets is what the wallet has displayed, not what it has verified. The check lives one level deeper, in the token's properties, where the contract address is written.

Faking the name is one of the techniques of address poisoning: a familiar name is slipped into a person's transfer history so that next time they copy the address from there. They go out in bulk, including as zero-value transfers: such a transfer is made from someone else's address — the one being planted — and the owner's consent is not needed, because for a zero amount the allowance every address has by default is enough.

The scale on Ethereum and BNB Smart Chain together, according to the explorer's analysis (texts captured 19.09.2026): 270,069,469 planted transfers to 17,438,722 addresses and confirmed losses of $83,835,216 over July 2022 – June 2024. We read the study itself in the explorer's retelling, not in the original. The number of holders a fake has measures the scale of the mailout, not trust.

The order of checking: five steps

1. Open the token's properties in your wallet and copy the contract address — not the name, not the ticker, not the icon.
2. Compare the string with the reference one character by character. In TRON, together with the case: TR7NHqje… and tr7nhqje… are different strings, and the second is invalid. In Ethereum the case can be ignored.
3. If your network is not in the issuer's list — that is the case with BNB Smart Chain — check against the explorer's label and against the address given by the party receiving the transfer.
4. Open the contract address in the explorer and see whether the source code is verified and whether the explorer knows the token's price.
5. In the same place, check the token's label and reputation and whether the name is hidden behind ERC20 ***.

What not to do. Do not type “USDT” into the explorer's search and take the first result: among the first 50 results there were at least thirty contracts with that ticker (measured 19.09.2026). And do not add a token by hand from an address “just in case” — the wallet's own documentation calls that route error-prone.

Short answers

There are two USDTs in the wallet — which one is real?

The one whose contract address matches the reference. The names and icons of both may be identical, and you cannot choose by them. Open the properties of each token and compare the addresses with the strings in the table above.

Can a fake token be sold?

We have not taken apart how such contracts are built, so we will not claim that it cannot be sold. But there is no reason to interact with it either: a fake is sent precisely so that you do something with it.

Why does a fake have tens of thousands of holders?

A person becomes a holder the moment a token is sent to them unasked — no consent is needed for that. So the number of holders a fake has measures the scale of the mailout, not trust in it. The real USDT on Ethereum has 17.3 million holders, the fakes in the sample have 18–87 thousand (19.09.2026), but that does not work as a sign of authenticity: whoever issued the fake makes their own holders.

Is it dangerous in itself that a fake token is sitting in the wallet?

An entry in someone else's contract does nothing by itself as long as you do not interact with it. The dangerous part is what you do with it: swapping, confirming allowances, following an address from its description.

We are an exchange service, and that changes only one thing: USDT reaches you on the TRON network, from our addresses, and its contract address is that same reference TRC20 string from the first row of the table above. The network is stated explicitly — a direction for USDT on the TRON network.