"Flash USDT" is sold on Telegram as software that sends Tether which "expires after 90 days". The demo looks convincing: the buyer gives a wallet address, a balance appears, the wallet shows the USDT logo. Then comes the licence fee, the activation key, the "network energy", the server slot. The files often carry a wallet stealer as a bonus.

The trick in the demo is simple. The balance is real, but it belongs to a token contract the seller deployed for a few dollars and named "Tether USD". Name and symbol are free text in any ERC-20. The only real identity of a token is its contract address. USDT balances live in Tether's own contract, and no program on your laptop can write to it.

Earlier in this series we looked at address poisoning , where the attacker fakes the recipient . This time the attacker fakes the payment .…