Predict.fun has pledged to reimburse affected users after reporting unauthorised wallet transfers totalling approximately 400,000 USDT. In its October 27 statement, the prediction market said a possible compromise of its externally hosted API documentation site was under investigation.
A separate blockchain investigation traced activity across two dates, suggesting the wallet drains began before the platform’s public disclosure.
Key Takeaways
- Predict.fun suspects its third-party API documentation site may have been compromised.
- Bitquery traced 397,708 USDT taken from 29 accounts on October 22 and 27.
- The platform promised reimbursement, but its announcement did not establish that payments had been completed.
Investigation Points to Wallet Owner Keys
According to Bitquery’s investigation, the transfers were signed using the affected wallets’ owner keys. The researcher found that none of the 33 transactions in its analysis interacted with Predict.fun’s market or exchange contracts.
That finding points to compromised wallet access rather than an identified flaw in the platform’s trading contracts. A private key authorises transactions; someone who obtains it may be able to move funds without needing the account holder’s permission.
Bitquery identified two waves of transfers, five days apart. It also reported another 4,900 USDT drain approximately an hour after Predict.fun’s statement. That later transfer illustrates why disabling a suspected entry point may not remove access already obtained through copied keys.
The researcher’s findings describe accounts and transactions, rather than a verified count of individual victims.
What Predict.fun Has Confirmed
In its October 27 response, Predict.fun said its preliminary review pointed to a possible compromise of the documentation website. It reported taking the site offline while investigating.
The company promised full reimbursement for losses directly resulting from the incident and said it would publish a detailed explanation after completing its investigation.
Its statement did not explain precisely how the suspected website compromise could have exposed wallet access. That connection remains a preliminary explanation.
Why Developer Tools Matter
Traders using automated crypto trading bots often connect software to accounts through developer tools. The permissions granted during setup determine what that software can do.
An exported wallet signing key can carry much broader authority than a credential restricted to reading market data. Reviewing where credentials are stored and which applications can access them is therefore part of crypto wallet security.
For affected users, the outstanding questions include the confirmed entry point, the scope of exposed credentials and the reimbursement process.
Conclusion
Predict.fun’s refund commitment addresses the reported financial losses, while the technical investigation must establish how wallet access was obtained. The available transaction analysis points to owner-key misuse, with the suspected documentation-site compromise still awaiting a definitive explanation.
