Predict.fun, a prediction market on BNB Chain, said on Tuesday 27 October that about 400,000 USDT had been moved out of a small number of user wallets without authorization, and promised to refund every affected user in full. The statement, posted on the platform’s official X account and relayed by crypto.news, TechFlow and PANews, points to a possible compromise of its API documentation website, which a third-party provider hosts. Independent trackers counted the Predict.fun hack differently: Naeven, quoted by Protos, found 19 victims and 105 ETH, worth roughly $260,000 by his estimate.
The figures do not match, and nobody has explained why. Predict.fun has not said how a documentation site could move money out of users’ wallets. A detailed post-mortem will follow once its investigation ends, it says.
What Predict.fun said about the 400,000 USDT
TechFlow carried the statement at 14:56 UTC, and PANews ran it at about the same time, so it was online by mid-afternoon in Europe. The platform has not published the times at which the thefts started or stopped.
As the outlets relay it, the statement covers the loss, the suspected cause and what comes next. About 400,000 USDT left a small number of user wallets without authorization. A preliminary investigation suggests the API documentation website, run by an outside host, may have been compromised for a short period. That site is offline and will stay closed until the investigation is over, with no date given for its return. A post-mortem and the measures meant to stop a repeat will come later.
On refunds, crypto.news quotes the platform word for word: it will “fully reimburse all affected users for any funds lost as a direct result of this incident”. There is no deadline and no claim procedure, and nothing says whether refunds will be paid in USDT. The Defiant led on the same pledge.
The provider hosting the documentation is not named. Nor does the statement say which chain the stolen USDT sat on, although the platform itself runs on BNB Chain.
What the trackers counted: 19 victims and 105 ETH
The alarm went up before the platform spoke. At 12:04 UTC TechFlow relayed an alert from the on-chain analysis account Onchain Lens: about $300,000 had left several Predict Fun contracts through intermediate wallets to Relay, a cross-chain service, and was then reportedly sent to Tornado Cash. FinanceFeeds, which reported the same alert, stressed that the figure was an estimate and that the alert did not identify any vulnerable contract.
Users spoke up too. An analyst who posts as Dethective said on 27 October that they had been drained of about $5,000. “I think there’s something wrong going on with Predict Fun and I am not the only victim,” Dethective wrote, according to Protos.
Naeven then followed the money. He counted 19 victims and a total of 105 ETH, which he valued at roughly $260,000. In his account, the funds were bridged to Ethereum and then sent on to Tornado Cash, the mixer used to break the link between deposits and withdrawals. “There are likely more victims,” he wrote, and he told users to bridge any remaining funds out of the platform. Protos said it had asked Predict.fun for comment and had no answer at the time.
Mixers come up again and again after thefts. Last week, the wallet behind the Drift exploit sent about 25,700 ETH through the same service, as we reported in our piece on the Drift exploiter’s Tornado Cash transfer.
Three figures for the Predict.fun hack, and no reconciliation
Readers will see different numbers depending on the outlet. Each comes from a different source, and none of the sources says how they relate.
| Figure | Source | What it covers |
|---|---|---|
| About 400,000 USDT | Predict.fun statement, 27 Oct, via crypto.news, TechFlow, PANews | Funds moved without authorization from a small number of user wallets |
| About $300,000 | Onchain Lens alert, via TechFlow (12:04 UTC) and FinanceFeeds, 27 Oct | Funds moved from Predict Fun contracts to Relay, then reportedly to Tornado Cash; an estimate |
| 105 ETH, about $260,000 | Tracker Naeven, via Protos, 27 Oct | Losses traced across 19 victims; funds bridged to Ethereum, then to Tornado Cash |
| About $5,000 | Analyst Dethective, via Protos, 27 Oct | One user’s own loss |
The gap between 400,000 USDT and 105 ETH is unexplained. Neither source says whether the counts cover the same wallets or the same hours, and we have no basis to reconcile them. The descriptions of timing differ as well: Naeven called the incident likely ongoing, while the platform speaks of a short period. Until Predict.fun publishes its post-mortem or someone shares the addresses involved, the question stays open.
For scale, DefiLlama showed about $13.71 million locked in Predict.fun on 23 October, nearly all of it on BNB Chain, according to FinanceFeeds. The outlet put the $300,000 estimate at roughly 2.2% of that.
We found no alert from the security firms that usually flag such drains, such as PeckShield, Cyvers or SlowMist, and no source has published attacker addresses or transaction hashes. This article names none.
How can a documentation site drain wallets?
The statement leaves this open. A documentation site explains how to use an API; it does not normally hold keys or move funds. Predict.fun says only that the site may have been compromised and does not describe the path from that site to users’ USDT.
Some coverage described the attack as phishing through a compromised interface. No source we could read confirms that, and crypto.news notes the statement does not say how the attacker got access to funds. What is known is general: attacks on code that a website loads from outside providers can push users into signing approvals or transfers they did not intend, without any flaw in the smart contracts. Whether that happened here is not established.
The API matters for context. According to crypto.news, Predict.fun introduced a developer dashboard on 1 September where developers create applications and generate or import API keys; earlier documentation described endpoints for placing and cancelling orders, market data, positions and account activity. Users who run trading bots are the ones most likely to read that documentation. That is a reason to wait for the post-mortem, not proof of the route the attacker took.
The same day, SlowMist described a different case of a tampered third-party script, a chat widget that swapped crypto deposit addresses, which we covered in our report on the Udesk script attack. For where hacks usually happen, see our guide on whether a blockchain can be hacked.
Who runs Predict.fun
Protos describes Predict.fun as a Polymarket-like market for the Binance ecosystem, founded by former Binance staff. Changpeng Zhao has said on X that it was incubated and funded by YZI Labs, the former Binance Labs. DefiLlama records its 2026 earnings at just over $9 million, according to the same report.
crypto.news adds that Predict.fun markets became reachable inside the Binance app through Binance Wallet in April. A follow-on investment from YZI Labs, involving Susquehanna Crypto, was disclosed the same month; figures shared on 2 April put cumulative volume above $1.8 billion since the December 2025 launch. Some markets also route USDT collateral through Venus Protocol to earn yield.
The incident lands while prediction markets draw record attention; Bitcoin contracts alone reached a reported $2.7 billion in a week on Kalshi and Polymarket, as described in our look at crypto prediction market volume.
The Polymarket precedent from June 2026
The closest earlier case is Polymarket’s. On 25 June 2026 it confirmed that a compromised third-party vendor had been used to inject malicious code into its website, served to some users, according to The Next Web. Its smart contracts were not exploited. PeckShield estimated about $3 million drained from more than 11 victims; the stolen PUSD was bridged from Polygon to Ethereum and converted into roughly 1,893 ETH. Polymarket said it had removed the affected dependency and was refunding victims in full.
On paper the cases look alike: an outside provider, a small group of victims, funds moved to Ethereum and a full refund pledge. The difference is the detail. Polymarket’s case came with a described mechanism, a script injected into its website. Predict.fun has so far named only the site it suspects.
What happens next with the refunds and the post-mortem
The refund process is the most pressing open point for victims: who qualifies under “direct result of this incident”, when payments arrive and in which asset. No later statement on it had appeared by the evening of 27 October.
The post-mortem should explain the mechanism and give a final count that can be checked against Naeven’s 19 victims and 105 ETH and Onchain Lens’s $300,000. The documentation site stays closed until then, with no reopening date.
Users who connected a wallet to Predict.fun, or used its API, can follow the platform’s official account for the refund details. Naeven’s advice to move remaining funds out was his own; the platform’s statement, as relayed, did not repeat it.