Predict Fun users lose $260K in ‘likely’ ongoing draining incident

Predict.fun is a BNB Chain prediction market built on the same wave of interest that pushed Polymarket to prominence after the 2024 US election cycle. Like most DeFi front ends, it relies on third-party infrastructure beyond its core contracts, in this case an external API documentation portal. That site, not the protocol's smart contracts, is where Predict.fun says the preliminary investigation points, a reminder that peripheral tooling is often the weakest link in otherwise audited systems.

Wallets that interacted with the compromised documentation portal had funds moved without authorization, with the running tally reaching roughly 400,000 USDT across user accounts. Affected holders cannot simply wait this out: Predict.fun has committed to full reimbursement, but users are left to document losses and watch for payout mechanics while the platform finishes its forensic review. Those who granted broad token approvals through the affected integration face the most direct exposure and should expect to revoke them.

A non-custodial prediction market advertising user control over funds still depends on centralized, externally hosted services that can be quietly altered, and this incident shows how little separates 'self-custody' from a single compromised webpage. Routing suspected proceeds through Ethereum into Tornado Cash also revives the familiar standoff between sanctioned mixing tools and investigators' ability to trace, but not necessarily recover, stolen crypto. Reimbursement pledges are welcome, but they also quietly concede that the product's security perimeter failed where it mattered.

Predict.fun's own count of about 400,000 USDT stolen, set against earlier on-chain tracing of roughly 105 ETH across at least 19 wallets, leaves open how large the final figure will be once the company's October 27, 2026 investigation closes. Watch for Predict.fun's follow-up disclosure naming the compromised vendor and detailing how reimbursements are calculated and distributed, which will determine whether this becomes a contained incident or a drawn-out reconciliation process for affected users.