Predict.fun: about 400,000 USDT drained from user wallets; third-party API docs site suspected
Predict.fun user smart wallets (BNB Chain)
On Oct 27 2026 the BNB Chain prediction market Predict.fun said a small number of users had unauthorized transfers from their wallets totaling about 400,000 USDT, and that its preliminary investigation points to a possible compromise of its API documentation site, hosted by a third-party provider. It took the docs site offline and promised to fully reimburse affected users and publish a post-mortem. Bitquery's on-chain analysis found 397,708 USDT taken from 29 accounts in two waves on Oct 22 and Oct 27, each transfer signed with the wallet's own owner key and no Predict.fun contract exploited, plus another 4,900 USDT drained about an hour after the statement.
Why this severity: About 400,000 USDT taken from roughly 29 user wallets; Predict.fun promises full reimbursement
- Started
- Oct 22, 2026
Affected
- Predict.fun user smart wallets whose owner keys were exposed
Fixed in
No fixed release yet
Timeline3
Second wave: 272,679 USDT drained; Predict.fun confirms about 400,000 USDT in unauthorized transfers, suspects its third-party-hosted API docs site and takes it offline.
Predict.fun pledges to fully reimburse affected users' direct losses and publish a post-mortem; another 4,900 USDT is drained about an hour after its statement.
First wave: 125,029 USDT moved out of user accounts, per on-chain analysis (not publicly reported at the time).
Advisories1
News & write-ups3
Notes & caveats
Predict.fun has not said how the docs site was used. Bitquery notes that API traders are told to export their wallet's owner key for bot trading, and that taking the docs site offline does not stop keys that were already copied.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
