Predict.fun Pledges Full Refunds After $400K USDT Wallet Hack

The confirmation landed at 14:33 UTC, according to the platform’s official post on X. Notably, it arrived just one day before the BNB Chain project announced its $PREDICT token.

What Predict.fun Confirmed

Predict.fun said its preliminary investigation points to its API documentation site as the weak link. That site runs on a third-party provider, and it may have been compromised for a short period.

As a precaution, the team took the docs site at dev.predict.fun offline. It will stay offline until the investigation wraps up. Meanwhile, the platform promised a full post-mortem once the review concludes.

The company also made a clear commitment. According to its statement, it will “fully reimburse all affected users for any funds lost as a direct result of this incident.” Founder dingaling added a short note on X: “Protect users.”

How the Predict.fun Hack Actually Worked

Here is the key detail. The victims’ own owner keys signed every drain transaction. In other words, the attacker never called or exploited a Predict.fun smart contract.

Predict.fun wallets are ZeroDev Kernel smart accounts, and each one is controlled by a single Privy-generated owner key. Users who want to run bots or trade through the API often export that key into their own code.

So a compromised docs site becomes dangerous. Attackers could inject malicious code that harvests pasted keys, or they could serve poisoned example snippets. Once an owner key leaks, the attacker can sign any transfer without touching the prediction market itself.

That pattern matches the on-chain evidence exactly. Because the thefts used valid owner keys, taking the docs site offline stops new leaks. It does not invalidate keys already exposed. Therefore affected users should treat any exported key as burned.

Following the Money On-Chain

On-chain analysis from Bitquery put the total at 397,708 USDT, which lines up closely with the official figure. According to its report, the funds came from 29 smart wallets across 33 transactions.

The drains arrived in two waves. First, about 125,029 USDT left 6 accounts on 22 October, with no public report at the time. Then roughly 272,679 USDT drained on 27 October, mostly between 5:00 and 5:54 AM UTC.

After each wave, the attacker moved fast. The funds bridged from BNB Chain to Ethereum through Relay, LI.FI, and Across. Subsequently, 166.8 ETH entered Tornado Cash in fixed-size deposits.

One more drain of about 4,900 USDT hit at 15:42 UTC on 27 October, after the public statement. That amount went to Railgun instead. So far, no major analytics firm has tagged the attacker’s identity.

A Hack One Day Before the $PREDICT Token

Predict.fun is a BNB Chain prediction market with a bio that reads “Powering prediction markets on @binance.” It uses a central limit order book and conditional tokens, much like Polymarket. YZi Labs, formerly Binance Labs, backs the project alongside Susquehanna Crypto.

The timing drew attention for an obvious reason. On 28 October, the team announced $PREDICT, a token with a 1 billion fixed supply and 16% unlocked at launch. The Season 1 airdrop allocates 70 million tokens, or 7%, from the ecosystem pool.

According to CoinMarketCap, pre-market perpetual pricing hovered near $1.42 during the period. That said, no clean sell-off tied directly to the Predict.fun hack appeared in the data reviewed. Platform TVL held around $10 million on DefiLlama.

Questions the Community Still Has

Reaction on X was cautious rather than panicked. Many users asked a fair question: how does a third-party docs site end up draining real wallets?

The answer sits in the key-export design, yet several unknowns remain. Predict.fun has not named the exact docs vendor. Likewise, the precise intrusion method, the full attacker addresses, and the complete victim list remain unconfirmed.

Some affected users still welcomed the response. One victim, @dethective, wrote that the explanation made sense. They had been building against the API all week and got drained. Reimbursement timing and eligibility, however, remain undefined.

What Happens Next for Predict.fun

For now, the docs site stays dark while the investigation continues. The promised post-mortem should clarify the vendor, the intrusion method, and the refund mechanics. Until then, users building against the API should rotate or abandon any exported keys.

The broader lesson is familiar across crypto. Smart contracts can be secure while the surrounding tooling stays exposed, and a single leaked key can undo strong architecture. The Predict.fun hack is a reminder that key hygiene matters as much as audited code.

This article is informational and not financial advice. Always do your own research before interacting with any platform or token.