TL;DR:
- Predict.fun confirmed unauthorized transfers totaling approximately 400,000 USDT originating from user wallets.
- The platform identified a potential temporary compromise on its third-party API documentation portal and took the service offline on October 27, 2026.
- Protocol management committed to reimbursing the total amount of stolen funds to affected holders once the technical investigation is concluded.
This Tuesday, October 27, Predict.fun confirmed an unauthorized transfer of approximately 400,000 USDT from the wallets of a small group of its users. Upon detecting the breach, the technical team proceeded to take its external API documentation portal offline and launched a forensic audit to clarify the attack vector.
We are aware of a small number of users who have experienced unauthorized transfers of funds from their wallets, totaling approximately 400,000 USDT.
Our preliminary investigation suggests that our API documentation site, which is hosted by a third-party provider, may have been…
— predict.fun (@predictdotfun) October 27, 2026
The incident was officially disclosed through a post on the protocol’s official X account during the early hours of Tuesday, October 27.
According to Predict.fun’s official statement, preliminary assessments indicate that the origin of the leak may be linked to the website hosting its Application Programming Interface (API) documentation. This portal was operated by an unspecified third-party infrastructure provider. The report specifies that the compromise of the resource occurred over a brief period.
As an immediate containment measure, the company revoked public access to all developer documentation.
The protocol’s leadership team assured that this technical resource will remain offline while the investigation progresses. According to official statements from the project, the developers will release a detailed technical post-mortem once the forensic analyses of the code and traffic logs are complete. In that same communication, entity spokespersons confirmed that they will reimburse the full amount of losses to each user who suffered direct theft as a result of the incident.
API Architecture and Protocol Operating Background
The prediction service operates on the BNB Chain network and featured automated trading tools for third parties.
On September 1, the platform rolled out a self-service dashboard aimed at software developers. With this tool, programmers could generate API keys, register applications, and configure rate limits. Prior to that date, technical credential requests were handled manually via support channels on the Discord platform.
The protocol’s technical documentation included functions for order placement, individual cancellations, and batch order removals.
Systems connected to the environment were able to query order book data, account balances, and market positions through real-time streams via WebSocket. To mitigate congestion risks, the team introduced volume controls on buy and sell transactions. Data from the technical documentation reveals that these restrictions took effect for new applications by default starting in the third quarter of 2026.
The firm’s operational expansion included financial infrastructure partnerships throughout the year.
On April 9, 2026, Binance Wallet integrated Predict.fun’s features within its app for authorized users. Under this architecture, bets and contracts executed directly on Predict.fun’s smart contracts while the wallet covered gas fees. Meanwhile, investment firm YZi Labs announced a funding round on April 2 with participation from Susquehanna Crypto. In that April financial report, the firm indicated that Predict.fun had recorded a cumulative trading volume exceeding $1.8 billion and over 4 million processed orders since its launch in December 2025.
The protocol’s liquidity model employs yield-generating mechanisms for stablecoin collateral.
Beginning July 15, 2026, the platform’s USDT contracts began routing collateral to Venus Protocol to generate interest. According to institutional documentation, these variable yields are distributed on a weekly basis among participants, with the protocol retaining a 10% administrative fee. The company warned at the time that withdrawal availability could depend on the liquidity levels recorded in the Venus Protocol pool.
Similar attacks previously impacted third-party infrastructure providers within the prediction industry.
On June 25, 2026, Polymarket reported an intrusion caused by a third-party vendor that enabled malicious script injection into its user interface. According to independent analysis published by blockchain researcher Specter on June 26, 2026, that incident resulted in transfers of approximately $2.94 million from 11 digital wallets.
Predict.fun announced that the publication of its post-mortem report and the launch of the reimbursement schedule for affected users will be formally communicated through its official channels once the ongoing security audits are finalized.
