Predict.fun, a BNB Chain-based prediction market, has confirmed that unauthorized transfers totaling approximately 400,000 USDT were taken from a small number of user wallets. The platform disclosed the incident on October 27, 2026, revealing that its preliminary investigation points to a possible compromise of its third-party API documentation site.
According to the official statement published on X, the externally hosted documentation portal may have been compromised for a short period, allowing an attacker to initiate unauthorized movements of funds from affected users' wallets. As an immediate containment measure, Predict.fun took the documentation site offline while forensic investigators examine the attack vector. The platform stated that the resource will remain unavailable until the investigation is complete.
"We will fully reimburse all affected users for any funds lost as a direct result of this incident," the company announced. A detailed post-mortem will be published once the technical analysis is finished, explaining the root cause and the steps being taken to prevent similar breaches in the future. The platform characterized the transfers as unauthorized movements originating from user wallets but has not yet described the specific technical route through which the attacker obtained access.
The incident follows the platform's rapid expansion throughout 2026. On September 1, Predict.fun launched a self-service developer dashboard allowing programmers to generate API keys, register applications, and monitor usage limits. In April 2026, Binance Wallet integrated Predict.fun's prediction-market features into its app, with the wallet covering gas fees while execution occurred through Predict.fun's smart contracts. Earlier that month, YZi Labs announced a follow-on investment in the platform, with participation from Susquehanna Crypto, citing cumulative trading volume above $1.8 billion and over 4 million processed orders since its December 2025 launch.
The platform's collateral model routes eligible USDT through Venus Protocol to generate yield, with the protocol retaining a 10% management fee. Variable yields are distributed weekly, though the company has warned that liquidity crunches at Venus could temporarily delay claims on winnings.
Predict.fun's breach echoes a similar incident in June 2026, when competitor Polymarket suffered a third-party vendor compromise that enabled malicious script injection. That attack resulted in losses estimated at $2.94 million across at least 11 wallets, according to blockchain analyst Specter. Polymarket also promised full refunds to affected users.
