27 Oct 2026 (UTC)
predict.fun: ~400K USDT Drained; Third-Party API Docs Site Suspected
predict.fun says ~400,000 USDT left a small number of user wallets; its third-party-hosted API docs site may have been compromised. Reimbursement pledged.
- Event date
- Incident typeWallet drains (developing)
- Bug classThird-party access
- Published
Loss, as sourced
'approximately 400,000 USDT', per predict.fun, which says it will fully reimburse affected users.
Traceability
Primary sources
In brief
Root cause: Preliminary, per predict.fun: its API documentation site, hosted by a third-party provider, may have been compromised. How keys or sessions were exposed: Unknown.
Timeline, as sourced: Statement 27 Oct 2026 14:33 UTC. Exact drain times Unknown. Post-mortem promised.
Account, as sourced
BNB Chain, 27 Oct 2026. predict.fun, a prediction market.
Per predict.fun (statement (opens in a new tab)): a small number of users experienced unauthorized transfers from their wallets, totaling approximately 400,000 USDT. Its preliminary investigation suggests the API documentation site, hosted by a third-party provider, may have been compromised. The docs site is offline until the investigation ends. The team says it will fully reimburse affected users and publish a full post-mortem.
Unknown: how keys or sessions were exposed, the number of wallets, exact times. Independent on-chain counts so far differ from the team's figure and are not used here.
Pattern: documentation that asks users to handle a key is part of the attack surface.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/predict-fun-api-docs-wallet-drains