SOL/SOL: the Cyrillic counterfeits that printed $330 billion of fake volume on Solana.

Corrected on 11 September 2026. The first version of this piece put the cluster's volume at $170 billion, its trades at 22,083 and its wallets at 56. A counting step had dropped swaps that the data stores only once, and had missed swaps listed under the other token in a pair. The figures, the volume table and both charts now use the corrected counts, and the BNB Chain section has been rewritten.

01 · The trick, in one glyphTwo letters that are not the same letter

Look at these two symbols, SOL and SОL. In most fonts they look the same. Put each letter's Unicode code point under it and the forgery gives itself away.

The middle letter of the second ticker comes from another alphabet. A Unicode inspector decodes it as Cyrillic capital O. Someone scanning a wallet or a DEX screener reads the two tickers as one symbol. Software that matches tokens by string sees two different assets.

The rest of the scheme is built on that one letter. Deploy a token whose symbol is SОL and a filter that blocks the plain word "SOL" will not catch it, yet anyone who sees it reads Solana. The same trick made the rest of the family we found: ВТС and WВТС for Bitcoin, USDС for USD Coin, USDТ for Tether, ТRX for Tron and ЕТН for Ether. We have met this alphabet before. Our address-poisoning investigation traced a fake Tether on Ethereum whose ticker hides a Cyrillic Dze and Te, and it reached over a million addresses. This time we pulled the 30 days of Solana DEX trades to 11 September through Bitquery MCP and traced the trading cluster behind the fakes.

02 · A market where both sides are fakeCounterfeits quoting counterfeits

You would expect a fake token to trade against a real one, fishing for victims. Mostly, these don't. The fake SОL's main pool is an Orca Whirlpool that pairs it with a fake USDT. That token's symbol is plain ASCII, but its mint starts with a vanity usd2; the real Tether mint starts with Es9v. The fake USDС trades mostly against the fake ТRX. The fake ВТС trades mostly against two more fakes, a "USDC" and a "USDT" with plain ASCII symbols. Nearly every price in this market is quoted in another forged asset, so whoever runs it can print any number on both sides of a trade.

The busiest wallet, GcsrTAWg9vxeDLwcWScM6q513W8PYkXBViHofESDsGM1, traded 16 of the 21 fakes and made 21,720 of the cluster's 27,401 trades. Three other wallets made almost all of the rest. This is wash trading at its simplest, with a handful of wallets moving tokens through pools nobody else uses. Our flip-hour investigation found the same small-wallet pattern behind fake Solana volume.

03 · The SOL/SOL poolsSelf-paired, so the pair reads like a typo

The oddest corner of the cluster is three small Orca Whirlpools, each pairing a fake SОL directly with real wrapped SOL. On any UI that renders symbols, the pair shows as SOL against SOL, the same coin on both sides. One of the pools did thirteen trades for about twenty dollars. Pools this small earn nothing. Their likely job is to tie the fake into the real coin's liquidity. A router can then find a price path to it, and a screener lists it as one more SOL market.

04 · The price is the productA counterfeit that tracks the real chart

The fake SОL's price stays close to real SOL's. Of the eleven days after its launch day that have a dollar close, it closed within five dollars of real SOL on eight. On the other three it trailed by eight to fifteen dollars. It sat near $94 for its first days, then jumped to about $104 on 28 August, a day after real SOL closed above $109. A closed loop does not drift toward the real price by chance, so the likeliest reading is that whoever runs it resets the fake's price from time to time.

The forged price does not stay on-chain. Data feeds that index every pool pick it up, and it shows up again on sites with real logos. Bitget Wallet's website has an auto-made "How to Buy SОL" page for the fake mint that prices it at about a hundred dollars. Birdeye's chart widget draws its candles. MyToken, a token listing site, quotes the fake usd2 Tether at a dollar. We have no reason to think any of these sites is in on it. Their feeds take in whatever trades, and this cluster traded $330 billion in a month.

05 · Where the real money wentAlmost nowhere

We measured every trade in the cluster where the other side was a real asset, meaning real USDC, wrapped SOL or Tether. Over the month, about $192K of real value went in and about the same came out. Nearly all of it sat in two pools that pair a fake Tether with real USDC. One wallet ran the first pool, two wallets ran the second, and each pool saw about 570 trades. That looks like the scheme's own float, keeping a dollar price alive. Every other pool that paired a fake with a real asset took in under fifty dollars of real money in the month.

So the DEX is not where this scheme makes money, if it makes any. Almost nobody is swapping real SOL for SОL. A fake with a live price is useful wherever a victim sees it. It can sit in a wallet as a four-figure balance, or stand in as the "payment" in an off-chain deal. Address poisoning works the same way, using the chain only as a display. We found no victims in this data, so treat that use as our reading of the pattern. The laptop token piece covered a plainer version of the trick, with thousands of contracts copying one memecoin's ticker.

06 · Beyond SolanaLookalike tickers on BNB Chain

Lookalike tickers turn up on BNB Chain too, and there they work differently. Hundreds of tokens whose symbols spell majors such as USDT, BTC or ETH in borrowed letters, like ՍՏⅮꓔ, traded there in August alone. Many sit at addresses ending in 8888, but Chinese-language meme coins on BNB Chain use that suffix too, so on its own it does not point to one crew. The bigger difference is who they trade with. From 12 to 31 August, almost all of their trades were against real USDT, USDC, BNB or BTCB, spread across thousands of wallets, for about $44 million of volume. Real money changes hands there, which makes it a different scheme from the closed loop on Solana.

07 · The quiet partZero tweets

Fake volume on a pump usually comes with a social media push. This cluster has none. On 11 September we searched X for the fake SОL's mint address and found zero posts, with no shills and no "gem" calls. Its likely audience is software, meaning the indexers and price feeds that read every pool.

We found no earlier public report of this cluster or its mints. Automated screens do catch them. Jupiter's token search flags every mint in the volume table as suspicious. The closest earlier work is general. The FBI warned about token-impersonation scams in 2024. In March, a GitHub issue asked Trust Wallet to act on a different set of fake USDT and SOL mints on Solana. It is still open, with no reply from the company. Its author wrote that "obvious scam tokens remain active in the wallet, while legitimate projects are rejected or delayed."

08 · The trading clockBusy from 02:00 UTC, near-silent by 22:00

Wash bots can run around the clock. This one does not. Bucket the cluster's trades by hour of day and a daily rhythm appears. Trading is heavy from 02:00 to 18:00 UTC, dips around midday, thins out from 19:00 and all but stops at 22:00. In the two hours before midnight UTC, the busiest wallet placed zero trades in the entire month, and the whole cluster managed nine.

Read as someone's sleep, the quiet hours point to a clock somewhere between UTC+3 and UTC+6. Treat that as a weak hint. A bot can run on any schedule, and a server clock says nothing about the person who set it up. The Cyrillic letters carry no clue about the people behind this either. The scheme uses them because they look like Latin ones.

09 · Screen it yourselfThree checks before you trust a symbol

If you build token lists, wallet UIs or screeners on DEX trade streams, the fix is cheap. Fold lookalike letters to Latin before you compare symbols, and identify tokens by mint address. A price that only exists inside a closed loop of forged quotes is no price at all.