# Predict.fun: about 400,000 USDT drained from user wallets; third-party API docs site suspected · pwn.watch > On Oct 27 2026 the BNB Chain prediction market Predict.fun said a small number of users had unauthorized transfers from their wallets totaling about 400,000 USDT, and that its preliminary investigation points to a possible compromise of its API documentation site, hosted by a third-party provider. It took the docs site offline and promised to fully reimburse affected users and publish a post-mortem. Bitquery's on-chain analysis found 397,708 USDT taken from 29 accounts in two waves on Oct 22 and Oct 27, each transfer signed with the wallet's own owner key and no Predict.fun contract exploited, plus another 4,900 USDT drained about an hour after the statement. Page: https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026 · generated 2026-10-28T16:19:55.836Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: Predict.fun user smart wallets (BNB Chain) - Started: 2026-10-22 - Affected: Predict.fun user smart wallets whose owner keys were exposed ## Follow this incident - RSS (one item per update): https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026.json - This file: https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: Second wave: 272,679 USDT drained; Predict.fun confirms about 400,000 USDT in unauthorized transfers, suspects its third-party-hosted API docs site and takes it offline. (https://x.com/predictdotfun/status/2115089547528950108) - 2026-10-27: Predict.fun pledges to fully reimburse affected users' direct losses and publish a post-mortem; another 4,900 USDT is drained about an hour after its statement. (https://www.tokenpost.com/news/technology/42298) - 2026-10-22: First wave: 125,029 USDT moved out of user accounts, per on-chain analysis (not publicly reported at the time). (https://bitquery.io/investigations/predict-fun-hack) ## Fix brief # Security brief: Predict.fun: about 400,000 USDT drained from user wallets; third-party API docs site suspected Source: https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 12:57 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is On Oct 27 2026 the BNB Chain prediction market Predict.fun said a small number of users had unauthorized transfers from their wallets totaling about 400,000 USDT, and that its preliminary investigation points to a possible compromise of its API documentation site, hosted by a third-party provider. It took the docs site offline and promised to fully reimburse affected users and publish a post-mortem. Bitquery's on-chain analysis found 397,708 USDT taken from 29 accounts in two waves on Oct 22 and Oct 27, each transfer signed with the wallet's own owner key and no Predict.fun contract exploited, plus another 4,900 USDT drained about an hour after the statement. Severity detail: About 400,000 USDT taken from roughly 29 user wallets; Predict.fun promises full reimbursement - Product: Predict.fun user smart wallets (BNB Chain) ## Affected versions - Predict.fun user smart wallets whose owner keys were exposed ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Latest updates - Oct 27, 2026: Second wave: 272,679 USDT drained; Predict.fun confirms about 400,000 USDT in unauthorized transfers, suspects its third-party-hosted API docs site and takes it offline. - Oct 27, 2026: Predict.fun pledges to fully reimburse affected users' direct losses and publish a post-mortem; another 4,900 USDT is drained about an hour after its statement. - Oct 22, 2026: First wave: 125,029 USDT moved out of user accounts, per on-chain analysis (not publicly reported at the time). ## Advisories - [Predict.fun statement on unauthorized wallet transfers](https://x.com/predictdotfun/status/2115089547528950108) (Predict.fun) ## Write-ups & news - [Predict.fun Hack: $398K Taken With Stolen Owner Keys](https://bitquery.io/investigations/predict-fun-hack) - [Predict.fun confirms 400,000 USDT theft, promises full refunds](https://crypto.news/predict-fun-400000-usdt-theft-refunds/) - [Predict.fun Wallet Transfers Began Five Days Before Disclosure](https://www.tokenpost.com/news/technology/42298) ## Caveats Predict.fun has not said how the docs site was used. Bitquery notes that API traders are told to export their wallet's owner key for bot trading, and that taking the docs site offline does not stop keys that were already copied. --- Machine-readable: https://pwn.watch/i/predict-fun-user-wallet-drain-400k-usdt-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.