Predict.fun user smart wallets hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 27, 2026 |
| Target type | Other |
| Loss | $397,708Price at time of incident |
| Method | Supply chain or frontend compromisePredict.fun suspects its API documentation site, hosted by a third-party provider, was compromised; each drain was signed with the user wallet’s owner key and no Predict.fun contract was exploited |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
Predict.fun is a prediction market on BNB Chain whose users trade from smart-contract wallets. On 27 October 2026 it said a small number of users had seen unauthorised transfers totalling about 400,000 USDT, and that its preliminary investigation suggested its API documentation site, hosted by a third-party provider, might have been compromised. It took the site offline, promised to reimburse every affected user for funds lost as a direct result, and said a post-mortem would follow.
Bitquery traced 397,708 USDT taken from 29 accounts in two waves, on 22 and 27 October. The first wave, 125,029 USDT from six accounts, had drawn no public report. Every drain was signed with the wallet’s own owner key, and none of the 33 drain transactions called a Predict.fun contract. Within two hours of each wave the money had crossed to Ethereum, and 166.8 ETH of it went into Tornado Cash. About an hour after Predict.fun’s statement one more account lost 4,900 USDT the same way.
How a documentation site led to owner keys being used has not been explained. Reimbursement had been promised but not confirmed as paid by 28 October.
Sources
- Predict.fun on X (27 October 2026)Primary · retrieved 2026-10-28
- Bitquery on-chain investigation (27 October 2026)Secondary · retrieved 2026-10-28
- Crypto Economy (October 2026)Secondary · retrieved 2026-10-28
Changes to this entry
- Recorded at Bitquery’s count of the two waves; Predict.fun’s rounded 400,000 USDT is the upper end. Revisit when the post-mortem names the cause.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Predict.fun user smart wallets hack — October 2026", iTokenly, accessed 2026-10-28, https://itokenly.com/hacks/predict-fun-smart-wallets-october-2026https://itokenly.com/hacks/predict-fun-smart-wallets-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.