Predict.fun has pledged to fully reimburse affected users after confirming unauthorized wallet transfers totaling approximately 400,000 USDT and identifying a possible compromise of its third-party API documentation site.
Summary
- Approximately 400,000 USDT was taken from a small number of user wallets, according to Predict.fun.
- A third-party API documentation site may have been compromised during a short period.
- The platform has taken the documentation site offline while its investigation continues.
- Affected users will receive full reimbursement, with a detailed post-mortem promised after the investigation.
Predict.fun said in an Oct. 27 statement that its preliminary investigation pointed to the externally hosted documentation site as a possible source of the incident. The BNB Chain prediction market described the affected group as a small number of users and said the suspected compromise may have lasted for a short period.
Predict.fun takes API documentation offline
By taking the documentation site offline, the company has suspended access to the resource while investigators examine what happened. Its statement says the site will remain unavailable until the investigation is complete, without setting a date for restoring access.
“We will fully reimburse all affected users for any funds lost as a direct result of this incident,” Predict.fun said.
The reimbursement commitment covers losses directly tied to the incident. In the same statement, the company promised to publish a full post-mortem explaining what happened and the steps it is taking to prevent similar incidents once its investigation is finished.
Predict.fun characterized the transfers as unauthorized movements from users’ wallets. Its preliminary explanation identifies the documentation site, hosted by an unnamed third-party provider, as potentially compromised, without describing the technical route through which the attacker obtained access to funds.
Developer tools support orders and account access
The company introduced a self-service developer dashboard on Sep. 1, as crypto.news previously reported. Predict.fun’s announcement described a portal where developers could create applications, generate API keys, import existing keys and monitor usage limits without relying entirely on support channels.
Before the dashboard became available, the platform’s developer documentation directed applicants to its Discord server to request an API key through a support ticket. Its REST API was described as a beta product, with developers asked to report problems through the same channel.
Documentation examined for that earlier coverage described endpoints for submitting orders, canceling individual orders and canceling groups of orders. Applications could retrieve market data, order books, account activity and user positions, while WebSocket connections supplied live data.
Alongside the dashboard, Predict.fun announced limits on bursts of order-creation and cancellation requests. New applications would have those controls enabled by default, while existing applications would receive them when their owners next requested a rate-limit adjustment, according to the release.
Predict.fun expanded wallet access and investor backing
Binance Wallet announced in-app prediction market access through Predict.fun on April 9. In the integration announcement, Binance Wallet described its role as providing access through the Binance app, with prediction-market activity executed through Predict.fun’s smart contracts.
Events, pricing and resolution rules remained operated by Predict.fun. Eligible users could take positions on outcomes across categories including sports, economics, world events and crypto, with contracts settling under the platform’s rules.
The announcement said users could trade with balances in their spot and funding accounts, while Binance Wallet sponsored trading and settlement gas fees. Access was described as available to eligible users, with the announcement presenting Predict.fun as a third-party integration.
Earlier that month, YZi Labs disclosed a follow-on investment in Predict.fun involving Susquehanna Crypto, the digital-asset arm of US trading firm Susquehanna International Group. Figures shared with the April 2 announcement put cumulative trading volume above $1.8 billion and processed orders above 4 million since the platform’s December 2025 launch.
YZi Labs described a self-custodial product combining gasless transactions with yield on collateral backing open positions. Predict.fun’s own July 15 explanation says eligible markets route USDT collateral through Venus Protocol, with interest attributed using on-chain position snapshots and distributed weekly. The platform takes a 10% management fee from earned yield, according to that explanation.
Predict.fun says the yield rate is not fixed and follows utilization of the USDT pool on Venus. Only markets carrying a Yield badge participate in the arrangement, and the platform monitors pool utilization before allowing new yield-bearing markets.
Its July explanation warns that a liquidity crunch at Venus can temporarily delay claims on winnings. The company says it can withdraw funds from Venus, convert affected markets to non-yield-bearing ones and pause the creation of new yield-bearing markets when liquidity conditions require it.
Polymarket promised refunds after a vendor compromise
A separate prediction-market incident in June involved a compromised third-party vendor at Polymarket. In its June 25 disclosure, the platform said an attacker used the vendor compromise to inject a malicious script into its frontend for some users.
Polymarket said it contained the incident, removed the affected dependency, and was contacting affected users to refund their losses in full. Blockchain analyst Specter estimated losses at $2.94 million across at least 11 wallets, according to June 26 coverage of the incident.
Specter described funds being taken from wallets holding PUSD, converted into ETH, and consolidated into a receiving address. The analyst characterized the incident as a phishing attack involving users who interacted with the compromised interface.
