In October 2021, a token called SQUID launched on BNB Chain, named after the Netflix series everyone was binge-watching. It had no affiliation with the show, but it did have a slick website, a roadmap full of “play-to-earn” promises, and a price chart that went vertical — rising by millions of percent within weeks. There was one detail buyers discovered only after buying: they could not sell. The contract allowed purchases but blocked every sell attempt that did not come from the developers. On November 1, 2021, the team drained what it could and the token collapsed to near zero, with reporting at the time placing the take at over $3.3 million. The BBC’s coverage and the Wikipedia case file are still worth reading, because nothing about the pattern has retired.
SQUID ran on BNB Chain (then called Binance Smart Chain), and that is not a coincidence. This guide covers why this chain attracts this exact scam, and the six checks to run before buying any BEP-20 token on it.
BLUF: Binance does not vet tokens on BNB Chain. The chain inherits every Ethereum-style smart contract scam — honeypots, rug pulls, hidden mints, fake locks — plus two accelerants: extremely cheap deployment and a brand name that new users misread as a safety guarantee. Verify the contract on BscScan, confirm the liquidity lock, hunt for tax and mint functions, check holder concentration, and cross-check with at least two automated detectors. Never rely on the token’s name, its website, or its association with “the Binance chain.”
Why BNB Chain has specific risk characteristics
The brand trust problem. BNB Chain is closely associated with Binance, the largest crypto exchange by volume. Many new users assume tokens on “Binance’s chain” carry some Binance stamp of approval. They do not. Binance validates blocks; it does not audit tokens. This assumption gap is actively exploited: fake tokens named after Binance products, “Binance-ecosystem” claims in marketing copy, and impersonation tokens that ride real announcements. The same brand-trust gap we covered in Base Chain token safety exists here in a stronger form, because the Binance association is older and more entrenched in newer markets.
Deployment is nearly free. Deploying a standard BEP-20 token on BNB Chain costs cents. A scam operation can deploy hundreds of token contracts, each a slight mutation of the last, A/B testing which front-end story converts. This is why the same scam appears under dozens of names within days of a trending narrative. When one impersonation token gets flagged, the next is already live.
PancakeSwap lists everything. The dominant DEX on BNB Chain, PancakeSwap, will route trades for any BEP-20 token with a pool, exactly as Uniswap does on Ethereum. A token being tradable on PancakeSwap means exactly one thing: someone added liquidity. It is not a listing, not an endorsement, not a due-diligence event. The venue being safe does not extend to the merchandise.
Impersonation economics. Because token names are free, the cheapest scam on the chain is a clone: deploy “SafeMoonFour”, “BNB2.0”, or a fake “BabyDoge” variant, buy a few influencer shoutouts, and let name confusion do the work. The more a real project trends, the more clones its name spawns.
Step-by-step: verifying a BEP-20 token
Step 1: Verify the contract on BscScan
BscScan is the block explorer for BNB Chain, operated by the Etherscan team. Get the token’s contract address — from the DEX page directly, never from a DM, an ad, or a screenshot — and search it.
Check for the verified badge on the Contract tab. An unverified contract on a token anyone can buy is close to disqualifying: legitimate teams verify source because it costs nothing and builds trust; scammers skip it because hiding the code hides the trap. If the contract is verified, you now have work to do — the code is readable, so read it.
Step 2: Read the tax functions
The signature BNB Chain scam is the sell tax. In the SQUID case, selling was blocked outright; the modern mutation applies a 99–100% tax only on sells, sometimes only after a countdown, sometimes only above a position size. In verified source, search for setFees, setTax, _taxFee, _sellFee, and any function with an onlyOwner modifier that writes a fee variable. Ask one question: what is the maximum tax the owner can set? A contract where the owner can raise the sell tax to 100% at will is a honeypot with a delay timer, whatever the current tax reads.
Step 3: Check the mint function
Search the verified source for mint( and for owner-callable functions that increase totalSupply. A live mint function means the team can dilute your position to zero at the moment of your maximum confidence. Some legitimate tokens keep a capped, timelocked mint — the cap and the timelock are the difference. An uncapped, instantly-callable mint is a hard no.
Step 4: Verify the liquidity lock — in the contract, not the badge
Rug pulls on BNB Chain usually exit through the liquidity pool. Check the pool on the token’s DEX page, then find the LP tokens: are they locked in a verified locker contract (Pink Lock, Team Finance, Uncx) with an expiry date you can read on-chain? Or does a plain EOA wallet hold them, able to pull liquidity this second? The lock badge on a website is marketing; the locker contract address on BscScan is the fact. Our liquidity lock verification guide walks through this chain-by-chain.
Step 5: Check holder concentration
On BscScan’s Holders tab, look at the top 10 wallets. A handful of wallets holding most of the supply — excluding the burn address and the locked LP — is a coordinated dump waiting for enough buyers to arrive. Also check whether the “locked” wallets are actually one entity across several addresses; consecutive creation timestamps are the tell.
Step 6: Cross-check automated detectors
Run the contract address through at least two of:
- honeypot.is — simulates buy-and-sell on BNB Chain contracts and reports the effective sell tax
- Token Sniffer — automated contract scoring with tax and owner-power checks (how we use it)
- GoPlus Security — aggregates tax, LP, and holder risk signals
A detector pass is necessary, not sufficient. Conditional honeypots — code that turns malicious after a date, a block number, or an ownership handoff to a zero address — are built specifically to pass simulation. That is why steps 2 and 3 happen in the source code, not in a scanner.
The recurring BNB Chain scam patterns
| Pattern | How it works | The tell |
|---|---|---|
| Honeypot / sell block | Buy works, sell reverts or taxes 100% | Sell simulation fails; owner-settable fees in source |
| Impersonation token | Clone names of trending or trusted projects | Contract is hours old; name rides a narrative |
| Fake lock | Website shows a lock badge, LP held by an EOA | No verified locker contract on BscScan |
| Mint rug | Owner mints unlimited supply into the pool | Uncapped mint( with onlyOwner |
| Influencer pump cycle | Paid shills, chart goes vertical, team exits | Concentrated holders + unlocked LP + new contract |
What this chain shares with every other chain
The deeper lesson from SQUID — and from the Solana, Base, Arbitrum, and Polygon equivalents we have covered — is that the chain never certifies the token. Low fees make scam deployment cheap on every modern chain; brand association (Coinbase, Binance) is borrowed trust that no chain operator extends to the tokens on it. The universal checklist — verified source, real lock, no owner backdoors, distributed holders — is the same everywhere. Only the tools’ URLs change.
If a token’s pitch leans on the chain’s brand instead of its own contract, that is not a safety argument. It is the pitch SQUID buyers believed.
This article is educational, not investment advice. Case facts (SQUID’s buy-only mechanics, the November 1, 2021 collapse, and the reported $3.3M+ take) are sourced to the BBC and Wikipedia case file linked above. For the general framework, see our ERC-20 token security check and the honeypot glossary entry.
Frequently Asked Questions
Does Binance verify tokens on BNB Chain?
No. Binance operates the chain and validates blocks, but it does not audit, approve, or vet any token deployed on BNB Chain. Anyone can deploy a BEP-20 contract for under a dollar. Names like 'Binance-verified' or 'BNB-approved' in a token's marketing are fabricated — there is no such program. Treat the Binance brand association as a marketing angle scammers exploit, not a safety signal.
What was the Squid Game (SQUID) token scam?
SQUID was a BEP-20 token launched in October 2021 on BNB Chain, riding the Netflix series name with no affiliation. The contract was a honeypot: buyers could purchase but a hidden mechanism blocked everyone except the developers from selling. The price rose thousands of percent, then collapsed to near zero on November 1, 2021, with reporting placing the developers' take above $3.3 million. It remains the textbook example of a sell-blocked token.
How do I check if a BNB Chain token is a honeypot?
Run the contract address through at least two honeypot detectors before buying: honeypot.is and Token Sniffer both simulate a buy-and-sell cycle against BNB Chain contracts and report whether the sell would revert. Then read the verified source on BscScan yourself and search for tax-setting functions (setFees, setTax, _taxFee) and owner-only modifiers. Detectors can be fooled by conditional logic that activates later, so a passing detector is necessary but not sufficient.
Is PancakeSwap safe for buying tokens?
PancakeSwap itself is an established, audited DEX — the swap contract is not the risk. The tokens listed on it are. PancakeSwap lists any BEP-20 token with a liquidity pool, with no vetting, same as Uniswap on Ethereum. The safe mental model: the venue is safe, the merchandise is not. All verification happens at the token level, using the contract address, not the exchange.