Predict.fun prediction market user lost 400K USDT transferred out without auth

[Karl_3000]

Yeah, I just checked again, and the site is up, but I couldn't do anything apart from viewing it. Maybe they didn't take it completely offline. It's my first time hearing about the site, but somehow, I feel like I've visited it before because the name sounds familiar.

The name is also very familiar to me. I have browsed about it to know if they have anything in the past that they have done on this forum before, but I did not see anything than the news of today that everyone is talking about which is the hack of $400000 from the prediction market by hackers. I think it would have been on the news that I heard about it because I like reading crypto news. The prediction market has a coin also which could be what I have seen before but forgotten about it.

Regardless, this shows that no platform is completely safe, especially those that integrate crypto services into their websites. Hackers are becoming more dangerous and sophisticated with their attacks, and no platform is completely safe from them. These platforms need to keep checking for security loopholes and fixing them before hackers discover and exploit them. It's really worrying that this year has been one of the worst for hacks, with major platforms and exchanges falling victim to attacks.

But I like how the site are making their customers not to lose their money, unlike how it was before that such thing can happen and the site will fold up and customers will lose. But amy coins that is not used to gamble should not be on a gambling or prediction market site.

[mak013]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

It is not a large sum. I believe it may even be beneficial - they lost a small amount in order to fix their security problems. That is cheap enough compared with what they could have lost.

Of course, I don't think they're happy, but it shouldn't become a problem - users get compensation, Predict.fun has fixed its security, and maybe it will get some compensation from the owner of the host where the API was hosted.

[Sim_card]

I don't understand if hacker are only targeting the prediction market, how they hack so easily, their evil is increasing with time

Not at all, they are targeting every big company rendering services and uses crypto. Hackers have hacked Bitget, coldcard wallet, Ledger, Duelbit casino and some that I cannot remember. It's like AI is really helping these hackers to succeed in these evil deeds.

[suzanne5223]

The website has been taken offline and will stay closed until the investigation concludes.

But I just checked, and the website is online, or am I missing something?

It' my first time hearing about this website too. No way I would be depositing $400,000 worth of crypto on a lesser-known platform even if I were a millionaire. I guess that is a warning shot to the users. I hope they get refunded.

Yes, but the website was offline for some time before it was back online, just like what a gambling platform we have on here did when they lost some funds in their hot wallet to bad actors.

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

A very typical nightmare in our world here. They now promised full compensation and if they were to do it, it is still a double-edged sword.

Yes, but this is just the beginning in the AI era we're in unless every AI company is giving certain compliance measures that prevent them from creating AI that will be used as a tool for bad actors.
About the compensation, I will have to give credit to Prediction market; I believe they are doing a great job lately.

[Davidvictorson]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

So it is true that there is a wave of attacks going on right now. I don’t know if it’s may have been connected to this incident, but it is something I think everyone should now be aware of including the creators of this website organizations. The most run is stress test on your systems to ensure that you would not be compromised if they ever get targeted. Users should withdraw their funds to a wallet , they have control over. No one knows when this would end or who showed be next.

[robelneo]

About the compensation, I will have to give credit to Prediction market; I believe they are doing a great job lately.

That's the easiest way to maintain their reputation and not back out of their responsibility; it's obvious that they want to continue their operations and remain competitive.

What happened had a huge impact on the price of their token in the market; the token was down 8%. Honestly, I only explored this particular prediction market in your thread and their token as well.

[alani123]

When DeFi is mixed with gambling these things are more likely to happen. I don't see much if any advsntsge mixing smart contracts with something that requires constant human intervention like a prediction market but here we go, someone did it. There are th consequences now. A huge theft where the platform loses funds that people had entrusted them with.

[Perfectbaby]

This is one thing I keeps advising people that before they start using any gambling or connects their wallet they should at least moves their funds to a newly created address so that if there's any fishing link connected to the site they won't completely get drained.
As I know you can't trust any site for any reason.

[lombok]

This is one thing I keeps advising people that before they start using any gambling or connects their wallet they should at least moves their funds to a newly created address so that if there's any fishing link connected to the site they won't completely get drained.
As I know you can't trust any site for any reason.

Isolating your investments in different wallet prior to their association with the entertainment website is an important protection step towards preserving your financial safety. And such a precaution measure is quite logical, considering the possibility of a fraudulent connection hidden behind each glitch in the carelessness of Internet users. Keeping your savings away from your working wallet will guarantee that your efforts won’t go down the drain due to hacking. Such high degree of alertness will enable you to be sure that your finances are always in your complete control, regardless of any guarantees of the website’s security system. And this approach to the problem provides an extra peace of mind during the game, since the amount of money you can lose is minimum.

[$crypto$]

Behind this hack they launched their own native token which will be released soon, 70,000,000 (7%) tokens for airdrop did you get it? But I see like no one is collecting points on this platform.
https://x.com/predictdotfun/status/2115328311752868024

Perhaps this can be said the first token of the prediction market.
So with the uproar this news does not seem to change their path, even immediately released according to its roadmap, meaning nothing is delayed.

[Hispo]

Behind this hack they launched their own native token which will be released soon, 70,000,000 (7%) tokens for airdrop did you get it? But I see like no one is collecting points on this platform.
https://x.com/predictdotfun/status/2115328311752868024

Perhaps this can be said the first token of the prediction market.
So with the uproar this news does not seem to change their path, even immediately released according to its roadmap, meaning nothing is delayed.

Indeed... This seems to be the first time I have read about a prediction market provider offering their own native token for anyone interested...
Not even Polymarket has dared to launch their own token in the same manner this platform has planned to do it.
Mostly because of regulatory obstacles, I assume...

I wonder if they have considered to use their own native token to compensate those people who have lost their money because of this exploit we are talking about.

[JeffBrad12]

This is one thing I keeps advising people that before they start using any gambling or connects their wallet they should at least moves their funds to a newly created address so that if there's any fishing link connected to the site they won't completely get drained.
As I know you can't trust any site for any reason.

I don't you think you understand the problem. Predictfun used 3rd party API documentation, and this is the problem because it gets exposed. It doesn't matter whether it's new or old wallet, since you're using predicfun and connect to its API. So you could potentially be drained as well.

Behind this hack they launched their own native token which will be released soon, 70,000,000 (7%) tokens for airdrop did you get it? But I see like no one is collecting points on this platform.
https://x.com/predictdotfun/status/2115328311752868024

Perhaps this can be said the first token of the prediction market.
So with the uproar this news does not seem to change their path, even immediately released according to its roadmap, meaning nothing is delayed.

Indeed... This seems to be the first time I have read about a prediction market provider offering their own native token for anyone interested...
Not even Polymarket has dared to launch their own token in the same manner this platform has planned to do it.
Mostly because of regulatory obstacles, I assume...

I wonder if they have considered to use their own native token to compensate those people who have lost their money because of this exploit we are talking about.

They're not offering native token for anyone interested. They issued their own token to be their governance as well as distributed it to all of their users. 400k is nothing for predict.fun and they won't use it to compensate their victims. They will use stable coin instead.

[Hispo]

...
They're not offering native token for anyone interested. They issued their own token to be their governance as well as distributed it to all of their users. 400k is nothing for predict.fun and they won't use it to compensate their victims. They will use stable coin instead.

Well, eventually anyone interested will have access to that token because people will be able to buy and selling on decentralized exchanges and also in some centralized exchanges (if it gets listed). It just takes enough people who get the air-drop to feel like selling their free tokens on Uniswap (when there is enough liquidity).

On the other hand, I don't understand why a prediction market would need to have communal governance in the same manner Uniswap has it. For decentralized exchanges it makes sense to have decentralized governance, but why would predict.fun need it?

[Yamifoud]

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

And the question is how long the refund will take. Because due to the long process of determining the issue and identifying who is at fault, the user will have to make another sacrifice.

Without authorization is too risky, and if you think about the safety assurance of your money, you should really think about it several times before using this. I think that user never expected that or might have missed reading the rules. Anyway, this situation serves as a lesson that not all features available on the platform are helpful.

[$crypto$]

I wonder if they have considered to use their own native token to compensate those people who have lost their money because of this exploit we are talking about.

There is no compensation from the token, the loss of funds has been borne by them, so none of the users have experienced an impact, at least that's their statement.

On the other hand, I don't understand why a prediction market would need to have communal governance in the same manner Uniswap has it. For decentralized exchanges it makes sense to have decentralized governance, but why would predict.fun need it?

Polymarket is also rumored to have its own token governance, but does not know when it will be launched.
https://blockworks.com/news/polymarket-cmo-confirms-poly-token
https://coinmarketcap.com/currencies/polymarket/

Ultimately this kind of Project wants to profit from the tokens they create, the goal is the same there.

[cryptomaniac_xxx]

Right, we are now the target here, every crypto related organization and services should review their security. Might be better to hire someone so that there will be no biased on the finding. It might entail some big money from organization, but still it's there duty to really hardened and should close the gap on the loopholes otherwise they will be the next victims here.

Just imagine if the amount that this criminals transferred in millions, that's one take in just one act from them. And if they go attacking like in every month, this criminals groups will really make a lot of money from us.

It is one thing to be aware and another thing to take decisive measure's in preventing such occurrences. This news of crypto platform hacks has been on for quite some time before now the question is how many Crypto organisation's made the move to upgrade their security mechanism? I would not be surprised to see that most of the organisations suffering this hacks today we're ignorant of the fact that they could be a possible target by these hackers therefore making them to feel too relaxed till they got stricken by the hackers blow.
Sometimes proactive measures could help save a platform from unforseen circumstances in the feature. For instance when the news of PHP vulnerability emerged, many platforms took the necessary steps to check and upgrade their servers and security just like how our admin here did just to make sure the platform is safe, secured and protected. Such proactive steps saves platforms a lot.

We might not get the numbers on how big or small organizations and services for that matter have upgraded their system because of this treat. But it's no brainer and there should not be anyone that is not doing anything to prevent this kind of things to happen to them. So there are no compromise, they will have to push their company to make some measures to hardened their security.

And so with that, yes, they need to be proactive and not just reactive to the things that is going around in the cryptosphere. It's like every week there will be flaws and vulnerabilities being discovered or worst, we have been attack already before we respond.

[Chibit01]

Those who use the platform and are somehow not affected, I will advise they don't use the wallet which has been connected there again because there is high chances of the private key having already been exposed.

I don't understand if hacker are only targeting the prediction market, how they hack so easily, their evil is increasing with time, it is becoming very difficult to control them, we are seeing some hacking news every day. Maybe hacker can quickly identify wallet weakness with the help of AI, as a result they are researching more on that issue and hacking, gradually they are becoming more powerful due to which they are easily hacking wallets and stealing money from common people. It is becoming very difficult to control them, which is really very painful.

I think we have very little list of affected prediction markets. These hackers are targeting and attacking anywhere they see they can steal from. As long as they see a vulnerability to exploit, they will go for it. Casino, exchanges and even data centers. No one escapes these hackers. This season AI appears to have made their work a bit easier this year with the number of companies they exploit increasing day by day.

[oll]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

$400,000 isn't a small sum, but it's also not that big for a crypto project (prediction). Even a small casino like Duelbits managed to recover from a $3 million theft. And this was their second theft in the last two years.
I recently learned about predict.fun, and it seems strange that even such small platforms turn to third-party services like API development. Because the API is an important channel for transmitting commands to the platform, which, if compromised, can easily withdraw user funds if it has the user's private keys or tokens.

[suzanne5223]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

So it is true that there is a wave of attacks going on right now. I don’t know if it’s may have been connected to this incident, but it is something I think everyone should now be aware of including the creators of this website organizations. The most run is stress test on your systems to ensure that you would not be compromised if they ever get targeted. Users should withdraw their funds to a wallet , they have control over. No one knows when this would end or who showed be next.

Yes, a wave of attacks is happening lately through the use of AI, which is being used to check the vulnerability of every platform in various settings round the clock, and this is just the beginning.
This is why the prediction market in the subject experienced a loss of 400,000 USDT.
About the stress test, it was done on this forum days ago when the php2shell issue happened, and people are advised to change their account password if they want to be extra safe and invalidate all of their sessions.

[bakasabo]

It will always be a mystery for me, why people keen on using least popular (maybe even unknown) services when there are always giants services, that have better reputation and are more popular. We have Kalshi, we have Polymarket, we have casinos that have started adding predictions, we have wallets like Metamask or Trust for example that offer placing prediction, but that is not enough. Some people prefer to find other decentralizes services and connect their wallets there.