- Trending
- Comments
- Latest
Predict.fun, a BNB Chain prediction market, said on 27 October 2026 that about 400,000 USDT was moved without authorization from a small number of user wallets, and promised to reimburse every affected user in full. Preliminary findings point to a third-party-hosted API documentation site as a possible source, and the platform has taken it offline.
Predict.fun said the suspected compromise may have occurred during a short period. It has taken the documentation site offline and said access will remain suspended until its investigation is complete, without announcing a restoration date.
The company described the losses as unauthorized transfers from users’ wallets. Its preliminary explanation points to a documentation site hosted by an unnamed third-party provider, but does not establish how an attacker gained access to the funds.
“We will fully reimburse all affected users for any funds lost as a direct result of this incident,” Predict.fun said in its statement.
The pledge covers losses attributable to the Predict.fun breach. The company also promised a detailed post-mortem explaining what happened and the measures it is taking to prevent a recurrence.
Several questions remain unresolved, including the precise technical cause and the number of affected wallets. The company’s description of a potentially compromised documentation site remains a preliminary finding rather than a completed assessment.
The Predict.fun breach follows the platform’s introduction of a self-service developer dashboard on Sept. 1. That portal allows developers to create applications, generate API keys, import existing keys and monitor usage limits without relying entirely on support staff.
Previously, developers seeking an API key were directed to open a support ticket through Predict.fun’s Discord server. The platform described its REST API as a beta product and asked developers to report problems through the same channel.
Documentation reviewed for earlier reporting described functions for submitting orders, canceling individual orders and canceling groups of orders. Applications could also retrieve market data, order books, account activity and user positions, while WebSocket connections provided live data.
Alongside the dashboard launch, Predict.fun introduced controls limiting bursts of order-creation and cancellation requests. Those controls applied by default to new applications. Existing applications were to receive them when their owners next requested a rate-limit adjustment.
These tools explain the documentation’s role within the developer ecosystem. They do not, however, establish the attack mechanism behind the Predict.fun breach, which the company has yet to disclose.
The Predict.fun breach comes after months of expansion for the platform, which launched in December 2025.
On April 9, Binance Wallet announced access to Predict.fun through the Binance app. Under that arrangement, prediction-market transactions were executed through Predict.fun’s smart contracts, while Predict.fun remained responsible for events, pricing and resolution rules.
Eligible users could take positions on sports, economics, world events and cryptocurrency outcomes using balances in their spot and funding accounts. Binance Wallet sponsored trading and settlement gas fees, presenting the service as a third-party integration.
Earlier that month, YZi Labs disclosed a follow-on investment involving Susquehanna Crypto, the digital-asset arm of U.S. trading firm Susquehanna International Group. Figures accompanying the April 2 announcement showed cumulative trading volume exceeding $1.8 billion and more than 4 million processed orders since launch.
Predict.fun also offers yield on collateral in eligible markets. Its July 15 explanation said those markets route USDT collateral through Venus Protocol, with interest calculated using on-chain position snapshots and distributed weekly. The platform charges a 10% management fee on earned yield.
Only markets displaying a Yield badge participate. Returns vary with utilization of the Venus USDT pool, and Predict.fun has warned that liquidity constraints can temporarily delay claims on winnings.
Those product arrangements provide context for the platform’s operations; the supplied account does not identify them as the cause of the Predict.fun breach.
The Predict.fun breach follows a separate third-party security incident at prediction-market platform Polymarket in June.
In a June 25 disclosure, Polymarket said an attacker had compromised a vendor and injected a malicious script into its frontend for some users. The company said it contained the incident, removed the affected dependency and began contacting affected users to reimburse their losses in full.
Blockchain analyst Specter estimated losses of $2.94 million across at least 11 wallets, according to June 26 reporting. The analyst described funds being taken from wallets holding PUSD, converted into ETH and consolidated at a receiving address.
That incident involved a disclosed malicious-script mechanism. Predict.fun has not yet provided an equivalent technical explanation, so the two cases cannot be assumed to share the same method.
For users affected by the Predict.fun breach, the outstanding developments are reimbursement and publication of the promised post-mortem. The documentation site remains offline while investigators work to establish what happened.
Copyright © 2025 - The Bit Gazette.
