Fake USDT sent from your wallet: the copy of your last payment

The short answer

It is not your transaction and nothing left your wallet. Someone created a token that looks like USDT or USDC and made it record a transfer from your address, for the same amount you just paid, to an address that looks like your recipient's.

The point is the address. The next time you pay that person and copy the last recipient from your history, you may pick the copy.

Eight copies in twelve minutes

29 May 2026, Ethereum. The sample wallet on this site paid 931 USDC to 0x48da2cb9…2ae7, and three minutes later 150 USDT to 0xac77efbe…8123. By 17:50 its history showed eight more payments of exactly those amounts.

Each real recipient got three different lookalikes. The first copy of each payment arrived 24 seconds after it.

That evening the same lookalikes came back as zero-value transfers: 0 USDC to 0x48da9b25…2ae7 at 20:45 and 0 USDT to 0xac77c7cc…8123 at 20:58. That is a different trick with the same goal.

At 21:46 a third kind arrived: 0.000000001 real ETH from 0x48dafa…2ae7, one more lookalike of the first recipient. The token is genuine, so the feed does not flag it.

How a fake token writes a transfer from you

A token is a contract, and a contract decides what its own Transfer events say. The fake one records a transfer from your address because its code says so. It needs no signature and no allowance from you, and your balance of real USDC or USDT does not change.

The first copy on 29 May was sent by 0x5565f1…52d6 through one of these contracts, and the same transaction wrote copies for 29 wallets. The same address sent the fake copy of a 650 USDT payment from this wallet on 1 August, two months later.

The symbols are built to pass a glance. Across the 40 copies on this wallet there are 14 different ones. ÚЅDТ uses a Cyrillic DZE for the S and a Cyrillic TE for the T. U឵S឵DΤ hides an invisible Khmer character between the letters. ꓴꓢꓓС is written in Lisu. Two copies simply say USDC: the letters are right, only the contract is wrong.

The favourite target

The recipient this wallet pays most often, 0x82d1b299…db67, has seven lookalikes in its history:

0x82d1b299ec11fe3f02d15a3ce6b35733ff45db67   the real recipient
0x82d1cdb1…db67
0x82d1439e…db67
0x82d15ef5…db67
0x82d1729c…db67
0x82d11603…db67
0x82d1f517…db67
0x82de9036…db67

On 1 June 2026 a real 50 USDT payment to it was followed by eight copies over the next two hours. The more often you pay someone, the more copies of them sit in your history.

What to do

• Leave the copies alone. There is nothing to revoke, and the fake tokens cannot be sold. A site that offers to swap them is an attack of its own.
• Never copy a recipient from your history. Use your address book, or ask the recipient for the address again.
• Compare characters from the middle of the address, not only the start and the end.
• Check the token, not only its name. The real contracts on Ethereum are below.

USDT   0xdac17f958d2ee523a2206206994597c13d831ec7
USDC   0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48

The same attack in other forms

• A 0 USDC or USDT transfer you never sent: the real token contract, tricked into recording a transfer of zero.
• Fake USDC or USDT in your wallet: tokens that arrive with a link in their name.

Check your own address

Paste an address on the front page. WalletHistory reads the last 500 transactions on ten EVM chains and flags every counterfeit token where it sits, so a copy never passes for a payment. There is nothing to connect and nothing to sign.

These rows are hidden by default. Switch off Hide spam in the Transactions tab to see each one in place. This is the wallet in this article.