Predict.fun prediction market user lost 400K USDT transferred out without auth

[Ishicryptic]

With the recent rates of hacks I'm not too surprised to hear about another one, although like some posters in this thread this is the first time that I'm coming across this Predict.fun prediction site although it's rather unfortunate that I had to learn about them because of their hack news. Their hack is similar to that of Polymarket which was also through a third party provider, I guess that through third party is where hackers can penetrate these prediction sites to steal their traders funds, I hope others like kalshi, should take note and fortify their third party providers if they have any. According to the report Predict.fun like Polymarket has promised to refund accounts that were affected by these breach, that is a good assurance but they should concentrate on beefing their securities to prevent further hacks.

[PX-Z]

I believe leaving APIs enabled by default, especially the ones that can move funds, is basically just like handing keys to whoever compromises the documentation or the third party service.
To be honest. I believe third service pltform that led to the hack of crypto related platform need to upgrade their service because security will be the most issue in the crypto space.

Also, there should be individual options for every feature enabled through the API, such as withdrawals, transfers, and other functions. These should be configurable separately after API access has been enabled, rather than automatically becoming available all at once. API access already takes time to get approved and configured, and these features carry significant technical and security risks. This shouldn't be treated as something newbie friendly or that needs UX. Since most platform today just priority UX not the security it might pose.

[Hispo]

With the recent rates of hacks I'm not too surprised to hear about another one, although like some posters in this thread this is the first time that I'm coming across this Predict.fun prediction site although it's rather unfortunate that I had to learn about them because of their hack news. Their hack is similar to that of Polymarket which was also through a third party provider, I guess that through third party is where hackers can penetrate these prediction sites to steal their traders funds, I hope others like kalshi, should take note and fortify their third party providers if they have any. According to the report Predict.fun like Polymarket has promised to refund accounts that were affected by these breach, that is a good assurance but they should concentrate on beefing their securities to prevent further hacks.

If the administration of Kalshi is not stupid, I am pretty sure they should have checked their third party providers by now, considering hackers seem to be on the loose and seeking vulnerabilities on prediction market providers.
In the same manner, this kind of hack will make those services to question their relationship with those third party providers, as it does not make sense to continue to involve third parties of they can be exploited and cost the company hundreds of thousands or even millions of dollars.

[EluguHcman]

It seems like every other day a major incident takes place and another platform gets liquidated. I've been saying here on the forum for a while now that this will only continue to get worse as attackers find new exploits everywhere. It goes without saying, and I know it’s inconvenient and extra work, that keeping your balance in your own wallet is what it takes for your security. Only transfer what's needed to place your bets, and withdraw before signing out. That is the only way to ensure you stay completely unaffected.

Mind you, it is not all crypto Industries or platforms that users who losses their funds and gets refunded. Even though the means was the fault of the platform.
We have already been hearing about how some users gets trapped in some crypto casinos while their objective was to make away with public funds.

I also learns how some of the sites disguises under reputations and after users being fallen in situations of loosing their funds in scenarios like this of the predict.fun prediction market, they only keep the victimized users hopeful to reimburse them but they never do. And when there is too many complaints they would just shutdown and lives users broken.

Some who values reputations and long term goals may consider to fulfil the statements in their terms. So let us keep fingers crossed on this one.

[Ojima-ojo]

With the recent rates of hacks I'm not too surprised to hear about another one, although like some posters in this thread this is the first time that I'm coming across this Predict.fun prediction site although it's rather unfortunate that I had to learn about them because of their hack news. Their hack is similar to that of Polymarket which was also through a third party provider, I guess that through third party is where hackers can penetrate these prediction sites to steal their traders funds, I hope others like kalshi, should take note and fortify their third party providers if they have any. According to the report Predict.fun like Polymarket has promised to refund accounts that were affected by these breach, that is a good assurance but they should concentrate on beefing their securities to prevent further hacks.

If the administration of Kalshi is not stupid, I am pretty sure they should have checked their third party providers by now, considering hackers seem to be on the loose and seeking vulnerabilities on prediction market providers.
In the same manner, this kind of hack will make those services to question their relationship with those third party providers, as it does not make sense to continue to involve third parties of they can be exploited and cost the company hundreds of thousands or even millions of dollars.

What is most surprising for me with recent cases of intruders into hot wallets and other means that hacker's have taken advantage, the third party thing, I mean the way that most hack incidents are pointed to third party, it seems that those thirds party connection are now creating more vulnerability.


This have to be checked, like for example platforms that engage third party service should be thoroughly checked and investigated each time, to uncovere any possible bugs or tempering with their security infrastructure.

[Miles2006]

It seems to be operating normally now, and it's good to know that they take responsibility for their users' losses and plan to reimburse them.

They promised for restoration of users' fund on the same day of hack itself but now they are back to functioning but I could not find any update on restoring users' funds. I know it is around 5 BTC worth of amount which may not be a big thing for prediction market operator still any update on users' fund would be a right thing to do while returning back to operate the platform in my opinion. I checked their news room but it seems any update yet to be released.

They probably need time to settle down before making any further move, they are fully back doesn’t mean every operation is back to normal considering the time and how early the whole hack situation happened, maybe they still need more time.
Sometimes, the prediction market will end up not refunding, though let’s watch out considering how they’re willing to keep a good reputation. I don’t know about this platform and honestly the fact nothing yet is mentioned or no specific date tells a lot about the management, I always wonder every time a hack is carried out, the company always look forward to dropping a statement about refunding when nothing is done yet, I guess this pattern is used to calm a lot of people from panicking.

[Cantsay]

Companies should start to make their security more secure so that this hackers won’t have a way in, losing money to hackers as a company is very bad and if the company is not financially stable they will close down.

Is it that hackers have mysteriously gotten some sort of information that allows them to exploit some system? This whole hack news left and right is becoming too much, just this Q4, there have been more hack cases than I can count with just one hand. Casinos, exchanges, and now prediction markets are also facing the same fate.

$400,000 is no joke, all of that went to an unknown individual who didn't do shit. I saw that it has all been moved to Tornado Cash, and we know what that means.

[Hispo]

With the recent rates of hacks I'm not too surprised to hear about another one, although like some posters in this thread this is the first time that I'm coming across this Predict.fun prediction site although it's rather unfortunate that I had to learn about them because of their hack news. Their hack is similar to that of Polymarket which was also through a third party provider, I guess that through third party is where hackers can penetrate these prediction sites to steal their traders funds, I hope others like kalshi, should take note and fortify their third party providers if they have any. According to the report Predict.fun like Polymarket has promised to refund accounts that were affected by these breach, that is a good assurance but they should concentrate on beefing their securities to prevent further hacks.

If the administration of Kalshi is not stupid, I am pretty sure they should have checked their third party providers by now, considering hackers seem to be on the loose and seeking vulnerabilities on prediction market providers.
In the same manner, this kind of hack will make those services to question their relationship with those third party providers, as it does not make sense to continue to involve third parties of they can be exploited and cost the company hundreds of thousands or even millions of dollars.

What is most surprising for me with recent cases of intruders into hot wallets and other means that hacker's have taken advantage, the third party thing, I mean the way that most hack incidents are pointed to third party, it seems that those thirds party connection are now creating more vulnerability.


This have to be checked, like for example platforms that engage third party service should be thoroughly checked and investigated each time, to uncovere any possible bugs or tempering with their security infrastructure.

Honestly, I don't even know why giants like Polymarket, Kalshi and others would need to rely part of their services on untrustworthy third party services. They already have millions and millions of dollars in revenue, which is more than enough to replace all those third party services with their own first party services.

It is similar to what happens with Trezor and ledger as manufacturers of Hardware wallets, they rely on third party services to handle their massive emails to their costumers, they also rely on third party services for their logistics and packaging, when they already have enough money to handle all those things by themselves, it is something I have never fully understood...

[CryptoBuds]

I believe leaving APIs enabled by default, especially the ones that can move funds, is basically just like handing keys to whoever compromises the documentation or the third party service.
To be honest. I believe third service pltform that led to the hack of crypto related platform need to upgrade their service because security will be the most issue in the crypto space.

Also, there should be individual options for every feature enabled through the API, such as withdrawals, transfers, and other functions. These should be configurable separately after API access has been enabled, rather than automatically becoming available all at once. API access already takes time to get approved and configured, and these features carry significant technical and security risks. This shouldn't be treated as something newbie friendly or that needs UX. Since most platform today just priority UX not the security it might pose.

I think it is not enough to just separate API permission. It is also crucial to consider where owner key is stored. And who has access to use it. Because from what I observed, unauthorized transfer in this incident were signed using by owner key.

In my opinion, sensitive operation should involve hardware backed signing, limited permissions, withdrawal allowlist and spending limit. If possible trading API should be restricted to specific task rather than being granted full control over wallet.

[Dogedegen]

It seems that the most common theme is like this. If it is not a direct social engineering compromise, it is a third party compromise or a supply chain compromise.  I wonder what it takes for companies to finally learn this lesson and stop integrating third parties services and stupid APIs. Where money is involved, the service should not be integrating anything and should be locked down as much as possible without compromising basic functionality. On the other hand I also wonder if the customers are to blame for this largely. How many gamblers care if the platform is very secure and doing things right or they mostly chase bonuses and hype and stuff like that? People complain about hacks and security, but then when they decide where to play and how they make the opposite choices.

I think if users actually chose platforms that prioritized security over everything else, the whole industry would advanced rapidly in the topic of security.

[Renampun]

It's great that they compensated the user directly from their funds.. This is also a lesson for them and other platforms, when it comes to user funds, they need to be careful and avoid making rash decisions that could put user funds at risk.. They have a responsibility to maintain user trust, and that means prioritizing security.. Especially as hackers have recently increased their attacks on crypto platforms, they need to continue improving their security systems and preparing for threats.

[PX-Z]

I think it is not enough to just separate API permission. It is also crucial to consider where owner key is stored. And who has access to use it. Because from what I observed, unauthorized transfer in this incident were signed using by owner key.

In my opinion, sensitive operation should involve hardware backed signing, limited permissions, withdrawal allowlist and spending limit. If possible trading API should be restricted to specific task rather than being granted full control over wallet.

I've read the incident on how the hackers made the hack, this is multistage hack campaign that last 5 months. From the initial hack of the devops device which was detected by them early then delete those devops credentials and everything from its device, but the hackers already know the names of those engineers. Which they targeted them on job platforms and made a fake interview jobs that lead to compromise one of their engineers again from the work of fake HR. And made an access to their internal AI tools from the compromised second engineer device, its tokens and map its network. Which lead to the hackers deployed a malicious software directly into the wallet infrastructure. And bypassed those human approval process.
This kind of of sophisticated hack is one of a kind like those great heist movies. Lmao.

It's great that they compensated the user directly from their funds.. This is also a lesson for them and other platforms, when it comes to user funds, they need to be careful and avoid making rash decisions that could put user funds at risk..

Idk what's the rash decision they made that you are talking though. As for the compensation, they should, they always announcing their SAFU fund, and thats the job of it

[leea-1334]

Wondering when the next big 'hack' will happen to a bigger prediction platform. You would imagine that these guys use a super solid API already in practice,,, or am I wrong to assume they used a less-popular one?

I've read the incident on how the hackers made the hack, this is multistage hack campaign that last 5 months. From the initial hack of the devops device which was detected by them early then delete those devops credentials and everything from its device, but the hackers already know the names of those engineers. Which they targeted them on job platforms and made a fake interview jobs that lead to compromise one of their engineers again from the work of fake HR.

Wait is this not the same exact way Binance got hacked? They explained it exactly like this, not related to Predict right?

[PX-Z]

...

Wait is this not the same exact way Binance got hacked? They explained it exactly like this, not related to Predict right?

Ah, yeah. This is related to binance, my bad, the Predict issue is api related as i mentioned earlier posts.

This should be an explaination how binance hackers get execute their plan, in which use sophisticated methods, and should be used as lesson to any platform that uses api or token to access their host or hot wallets on the platform.

[davis196]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

Does predict.fun have anything in common with the famous pump.fun memecoin platform(other than the similar sounding domain names)?
I'm too lazy to check this right now. All those small predictions markets, casinos and sports betting platforms shouldn't rely on third-party service providers to handle everything. I have the feeling that the compensation, which is promised by the predict.fun team won't be paid and that particular case might be an exit scam. The owners of this platform will suffer big losses and missed profits, if the website remains closed until the investigation is complete. How are they going to pay out 400K USDT, if they don't generate any revenue and profits?

[salad daging]

I wonder what it takes for companies to finally learn this lesson and stop integrating third parties services and stupid APIs.

Integrating the API on their platform is very useful for their customers, they can execute trades faster including in Polymarket see betting market predictions in real-time and quickly, this is an advantage for the platform on the other hand there is always a gap where third parties are targeted.

On the other hand I also wonder if the customers are to blame for this largely.

Some customers cannot be blamed for this, they only use the API features that have been provided, so the security is really up to the third party themselves how strong the security system is.

Again this is the choice of some customers, you can use this feature or not is up to you.

[Orpichukwu]

Wondering when the next big 'hack' will happen to a bigger prediction platform. You would imagine that these guys use a super solid API already in practice,,, or am I wrong to assume they used a less-popular one?

Next big hack: Polymarket has also been compromised just a few days after the prediction.Fun was hacked the same day. Binance was also hacked; the next big one is what we can’t tell, but just wait and see who they go for next. That's if those platforms are not building a defense against the attackers.

[suzanne5223]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

Does predict.fun have anything in common with the famous pump.fun memecoin platform(other than the similar sounding domain names)?
I'm too lazy to check this right now. All those small predictions markets, casinos and sports betting platforms shouldn't rely on third-party service providers to handle everything. I have the feeling that the compensation, which is promised by the predict.fun team won't be paid and that particular case might be an exit scam. The owners of this platform will suffer big losses and missed profits, if the website remains closed until the investigation is complete. How are they going to pay out 400K USDT, if they don't generate any revenue and profits?

I never had the impression that the platform had something in common until you mentioned it now, and from my research I don't see any connection between the prediction market and pump.fun beyond the .fun domain.
Predict.fun is a BNB Chain prediction market (integrated with Binance Wallet, incubated by YZi Labs), while Pump.fun is the Solana memecoin launcher.
This shows that they are completely from different teams and products.
I wouldn't consider Predict.fun to be small if i were you, and the money they can easily generate, since prediction markets are currently in their prime.

[Supreme Donvic]

It's great that they compensated the user directly from their funds.. This is also a lesson for them and other platforms, when it comes to user funds, they need to be careful and avoid making rash decisions that could put user funds at risk.. They have a responsibility to maintain user trust, and that means prioritizing security.. Especially as hackers have recently increased their attacks on crypto platforms, they need to continue improving their security systems and preparing for threats.

Some companies are still being reluctant in making their security more strong, now that hackers are everywhere hacking different companies others will not learn, I think it is time for companies to make their security more stronger, don't wait for them to hack your company, learn from others and start making your security strong so hackers can't want to get in.
If as a company your responsibility is to hold people's funds you need to make sure that you do it very well and you put every security in place so that people will not lose their money.
Yes it is a great thing that they compensated and this is what a reasonable company is supposed to do.

[Pandu Geddon]

Some companies are still being reluctant in making their security more strong, now that hackers are everywhere hacking different companies others will not learn, I think it is time for companies to make their security more stronger, don't wait for them to hack your company, learn from others and start making your security strong so hackers can't want to get in.
If as a company your responsibility is to hold people's funds you need to make sure that you do it very well and you put every security in place so that people will not lose their money.
Yes it is a great thing that they compensated and this is what a reasonable company is supposed to do.

Ideally, every platform should have a team responsible for continuously updating and ensuring that their security system functions properly. If a mistake occurs involving users' funds on the platform, of course, it is the platform's responsibility to provide compensation. Hacking on a large platform might not cause issues in making compensation payments. But for a platform that might be on a local scale, this could become quite serious. There are many hacking incidents happening today, so it is wiser to be cautious when leaving money on exchanges, casinos, or other platforms.