Slowmist, in collaboration with Imtoken, has uncovered a fresh cryptocurrency scam exploiting offline transactions and utilizing USDT. Scammers manipulate Ethereum RPC to fabricate USDT balances in victims' wallets. They coax victims into altering their Ethereum RPC URL to a controlled one, creating the illusion of USDT deposits, but leaving them with empty hands during transactions. Moreover, the scheme employs small transfers to gain trust before manipulating account balances and contract details, posing substantial risks to unsuspecting users. This scam is associated with broader pig butchering scam operations, amplifying the threat to cryptocurrency users.