Predict.fun prediction market user lost 400K USDT transferred out without auth

[$crypto$]

It will always be a mystery for me, why people keen on using least popular (maybe even unknown) services when there are always giants services, that have better reputation and are more popular. We have Kalshi, we have Polymarket, we have casinos that have started adding predictions, we have wallets like Metamask or Trust for example that offer placing prediction, but that is not enough. Some people prefer to find other decentralizes services and connect their wallets there.

People are chasing PREDICT tokens that will be listed on Binance, unfortunately with hacking incidents happening on this exchange there is a delay in listing, then I think people betting on this platform get their tokens.
https://www.binance.com/en/support/announcement/detail/eb1fb9e5f41f43b682332aff0b7b89ce?utm_source=EnglishTelegram&utm_medium=GlobalCommunity&utm_campaign=AnnouncementBot

Polyamrket --- got hacked.
Kalshi --- just waiting for her moment, not expecting who knows to be the target of hackers.

As for the same casino or Metamask Trustwallet offers prediction markets for those perhaps lacking thrills.

[r_victory]

It seems to be operating normally now, and it's good to know that they take responsibility for their users' losses and plan to reimburse them. Attacks have increased considerably, and most were due to failures in outsourced services or negligence on the part of the team. Although many are aware of the security measures that should be taken, they are still careless. Hackers don't always need sophisticated attacks; they practically enter through the front door.

[BitBakerr1]

It seems to be operating normally now, and it's good to know that they take responsibility for their users' losses and plan to reimburse them. Attacks have increased considerably, and most were due to failures in outsourced services or negligence on the part of the team. Although many are aware of the security measures that should be taken, they are still careless. Hackers don't always need sophisticated attacks; they practically enter through the front door.

Any serious company that wants to continue their business after a hack will always take responsibility to pay back their customers money because there customers was not the reason for the hack, the only time a company will decide not to pay back their customers there money after a hack is when they want to close down there company, if you don’t close down the company and you decide not to pay your customers there money you are going to have a bad reputation and no body will be comfortable with your company anymore.

Companies should start to make their security more secure so that this hackers won’t have a way in, losing money to hackers as a company is very bad and if the company is not financially stable they will close down.

[henmark]

It seems to be operating normally now, and it's good to know that they take responsibility for their users' losses and plan to reimburse them.

They promised for restoration of users' fund on the same day of hack itself but now they are back to functioning but I could not find any update on restoring users' funds. I know it is around 5 BTC worth of amount which may not be a big thing for prediction market operator still any update on users' fund would be a right thing to do while returning back to operate the platform in my opinion. I checked their news room but it seems any update yet to be released.

Although many are aware of the security measures that should be taken, they are still careless.

It happened through third party service provider's API compromises and if you have noticed few other hacking also happened through third party services. Hope all services will secure themselves before hackers exploit anything further.

[PX-Z]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period.

I haven't read supporting news and articles of this yet, but technically speaking, if the API is used and it is really compromised on this unauthorized transaction, obviously, auth is not needed. This is common and a serious security risk known as unauthenticated API abuse.
That's why API should be off by default and should not be used by just common users., it should be requested with other supporting details if used by whatever reason of the user and should known the risk before enabing and using it.

[YOSHIE]

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

It seems that hackers are getting more sophisticated day by day, they are targeting the top online platforms, and now the Predict.fun prediction market platform is being targeted by hackers.

What's strange I see from the statement from Predict.fun.

No Smart Contract Hacks: On-chain analysis shows that Predict.fun's main smart contract remains secure and has not experienced any code exploits. Pure withdrawal transactions are signed using the private key of the affected wallet.

User Impact: This incident drained funds from approximately 29 user wallets with a total loss of approximately 397,708 USDT. The stolen funds were then bridged to the Ethereum network and channeled to the Tornado Cash crypto mixer to obscure the transaction trail.

What's strange this time is that the target is on the user as stated in the quote above, not on the prediction platform, really nothing is safe anymore on today's online platforms.

[Agbe]

This is one problem that comes with relying on a third services provider. That is why most times I don't even trust Casinos who claims to be KYC free but rely on a third service provider for their services, if the third party involved get compromised at any point in time the whole blame will bounce back to the casino. Just like what we have seen here on predict.fun where users has lost money due to compromise in the part of third party service provider and the whole blame is now on predict.fun.

Thank God that the platform has accepted responsibility on their own end and has promised to compensate all those who has lost money due to what has happened .

[Donk1]

​Well Personally to me I feel scenarios like this often happen in the crypto space, and while nobody can say for certain whether or not they will keep it their terms by talking about taking immediately responsibility about the compensation for user , it's good though, but still until after the investigation is done the outcome still vary which means anything can happen at this point in time .best to say from their perspective, I am sure they will do everything they can because if not they will both lose their reputation and their business. So yeah that's all.....

[Asuspawer09]

Not familiar with this Predict.fun website, I just checked it, and it seems kinda like a normal prediction market like what others look like, checked online, and they were running already for almost a year, started in December 2025.

Seems like there are a lot of websites are vulnerable these days it seems so concerning that there are a lot of platforms getting hack, last time I remeber was a casino getting hack, then a popular exchange.

The website has been taken offline and will stay closed until the investigation concludes.

But I just checked, and the website is online, or am I missing something?

It' my first time hearing about this website too. No way I would be depositing $400,000 worth of crypto on a lesser-known platform even if I were a millionaire. I guess that is a warning shot to the users. I hope they get refunded.

The website is already online again, seems like they already fixed the issue.

The 400,000$ worth was an accumulated amount from the wallets that got compromised, for sure, no one is going to deposit a huge amount to these centralized platforms, even if you are a millionaire of something, unless they are planning to gamble all of it.

[Odusko]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

Low liquidity platforms are not also spared from the hacking and extortion going on in the crypto casino and predictions market, $400,000 is quite a Small amount compared to millions that have been lost to the various hackes incidents, predictions market in an unchain network will definitely pause risk to all actors.

Sometimes, I use to think if this whole wallet comprised or data comprised and all the third party involvements in all the hack seems to be an organized operations.

[CucakRowo]

I could see each drain was signed using owners private keys.
So, this is not any smart contract exploit. Its a direct compromise of the key.

This means that third party API documentation site has been compromised or leaked in some way. Or they injected something that allowed attacker to obtain private key or force approval. For platforms that wish to survive, providing refund is bare minimum responsibility.

And, if you connect hot wallet to any platform that hasn't been battle tested over long period, keep only amount in it that you wouldn't mind losing overnight.

[el che]

It seems like every other day a major incident takes place and another platform gets liquidated. I've been saying here on the forum for a while now that this will only continue to get worse as attackers find new exploits everywhere. It goes without saying, and I know it’s inconvenient and extra work, that keeping your balance in your own wallet is what it takes for your security. Only transfer what's needed to place your bets, and withdraw before signing out. That is the only way to ensure you stay completely unaffected.

[Smartprofit]

As far as I understand, hackers stole API documentation from a third-party website and replaced part of the code. 🙋

This is a very clever attack... Developers usually trust technical documentation. If you're a developer and don't trust the basics (technical documentation), it's practically impossible to work.

This attack most likely affected experienced users, not regular players who place bets manually. They're the ones who use bots, APIs, etc. This confirms the principle "the simpler, the more reliable." Strictly speaking, this isn't a direct attack on the Web 3.0 system. It's more of a proxy attack on Web 3.0 through the Web 2.0 system. Hackers compromised a simple website, and as a result, blockchain users suffered. The 20th century has triumphed over the 21st century. The paradox, in my opinion, is that using cryptocurrency blockchains, we don't see the entire cryptocurrency ecosystem. But hackers have a bird's eye view and are successfully finding vulnerabilities in the system.  🤷

[Texac]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

In my opinion, worst part of this situation is that vulnerability was apparently not in Predict.fun platform itself, but in infrastructure of third party service provider.
Of course, promising to fully compensate affected user for their loss is right decision, and it could help maintain trust in platform. But what's important here isn't just returning the 400000 USDT, but finding out exactly how attackers managed to transfer fund from users wallet.   After all, next attack like this could end up costing users a lot more.

[Hispo]

It seems like every other day a major incident takes place and another platform gets liquidated. I've been saying here on the forum for a while now that this will only continue to get worse as attackers find new exploits everywhere. It goes without saying, and I know it’s inconvenient and extra work, that keeping your balance in your own wallet is what it takes for your security. Only transfer what's needed to place your bets, and withdraw before signing out. That is the only way to ensure you stay completely unaffected.

After the hack against Binance, there was a huge outflow of money to private wallets, and I am sure there have been millions of dollars being withdrawn from casinos and exchanges completely out of fear to hacks and exploits.

It seems we are entering a new era in which centralized services will have to be more careful and will ask for even more stuff in order to process withdrawals, as a way to protect themselves from thieves.

Stake was hacked, Binances was hacked, and so on... Even hardware wallets have gotten hit by thieves.

[Obari]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period. The website has been taken offline and will stay closed until the investigation concludes.

Predict.fun assures full compensation to users who have directly suffered losses from this incident and will issue a comprehensive review report and outline follow-up preventative measures once the investigation is complete.

https://x.com/predictdotfun/status/2115089547528950108

The rate of the tack on the crypto market is machining really alarming and it is even becoming more difficult to conclude if these attacks are totally from outsiders without having some intel from the inside of the team because people and their level of greed and selfishness is really unimaginable but whichever the case might be, we need to start taking our safety and security very serious considering the high rate of scams and hacks in crypto related industries and we should always try to ensure we have the 2FA activated at all times.

[Peanutswar]

First time seeing their platform and never been use but if ever they will assure that the users funds will be get back to their owners or even they get paid they can get their reputation back but of course there is a chance that other players of their platform will not back anymore and find another that they will feel safe and secure. There are no system safe previously even reputable and secure ones get hacked so for the end users its an enlightenment to avoid storing a huge amount into these platfroms if they aren't using their money.

[Zlantann]

First time seeing their platform and never been use but if ever they will assure that the users funds will be get back to their owners or even they get paid they can get their reputation back but of course there is a chance that other players of their platform will not back anymore and find another that they will feel safe and secure. There are no system safe previously even reputable and secure ones get hacked so for the end users its an enlightenment to avoid storing a huge amount into these platfroms if they aren't using their money.

Some big companies have also been hacked recently, and they are doing damage control. If the company can refund everyone who was affected and assure users that their funds are safe, some people might continue using them. I don't know why people have not learned their lessons about keeping large funds on gambling platforms. These platforms are prone to hacks; that is why I withdraw my wins to avoid keeping large amounts in my gambling accounts.

[suzanne5223]

Predict.fun, a prediction market platform on the BNB Chain, has been the scene of unauthorized fund transfers from users' wallets, leading to a collective loss of about 400,000 USDT. Early investigations suggest that the third-party service provider's website, which hosts the API documentation, might have been compromised, impacting a few users over a short period.

I haven't read supporting news and articles of this yet, but technically speaking, if the API is used and it is really compromised on this unauthorized transaction, obviously, auth is not needed. This is common and a serious security risk known as unauthenticated API abuse.
That's why API should be off by default and should not be used by just common users., it should be requested with other supporting details if used by whatever reason of the user and should known the risk before enabing and using it.

That's correct.
I believe leaving APIs enabled by default, especially the ones that can move funds, is basically just like handing keys to whoever compromises the documentation or the third party service.
To be honest. I believe third service pltform that led to the hack of crypto related platform need to upgrade their service because security will be the most issue in the crypto space.

[lombok]

First time seeing their platform and never been use but if ever they will assure that the users funds will be get back to their owners or even they get paid they can get their reputation back but of course there is a chance that other players of their platform will not back anymore and find another that they will feel safe and secure. There are no system safe previously even reputable and secure ones get hacked so for the end users its an enlightenment to avoid storing a huge amount into these platfroms if they aren't using their money.

Some big companies have also been hacked recently, and they are doing damage control. If the company can refund everyone who was affected and assure users that their funds are safe, some people might continue using them. I don't know why people have not learned their lessons about keeping large funds on gambling platforms. These platforms are prone to hacks; that is why I withdraw my wins to avoid keeping large amounts in my gambling accounts.

Yes, always do some research about the new league or team before placing any bet on it. The little effort you will take to look for information about the unknown can save you lot of money. The process of impersonating is now very easy, and the platform can look legitimate and be very fragile. In case the managers offer player refunding, the reputation of the platform may improve, but some players will not come back again. There are no foolproof systems, and the good platforms can still be hacked. Thus, it is always good to withdraw your money immediately after winning, so that your money does not remain idle in your gambling account.