Predict.fun Pledges Full Repayment of 400,000 USDT Taken From 29 Wallets

Compensation Pledge for Direct Losses

Prediction market platform Predict.fun has promised full compensation to users who suffered direct losses in a wallet incident, sizing the damage at roughly 400,000 USDT, the dollar-pegged stablecoin issued by Tether. In a statement released on Tuesday, October 27, the company said unauthorized transfers had occurred in a small number of user wallets and that its repayment commitment covers everyone who lost funds directly in the event. The figure the company published is the scale of the damage, not an announcement that the reimbursements are already complete. Only users with direct losses fall inside the pledge, which the company framed as a commitment rather than a completed payout.

The losses built up across two waves, with the first transfers on Thursday, October 22 and the second batch on Tuesday, October 27, drawn from 29 user wallets in total. The USDT price stayed at its dollar peg throughout, so the episode is a custody and key-security failure rather than a market event. Predict.fun's preliminary finding identifies a short-lived compromise of an API documentation site hosted by an external vendor as the possible entry point, and the company has taken that site offline until the investigation finishes. It stressed that the suspected breach of the documentation site is an initial judgment; the route from that site to the unauthorized wallet transfers has not been confirmed. The platform has not disclosed how many users were affected, a timeline for completing the repayments, or whether the affected wallets shared any infrastructure or service provider. It committed to publishing a post-mortem report setting out the sequence of events and the measures taken to prevent a repeat once the investigation concludes.

On-Chain Trail Through Tornado Cash

On-chain analytics firm Bitquery examined BNB Chain transaction records and tallied two outflow waves totaling 397,708 USDT, a sum that lands close to the roughly 400,000 USDT Predict.fun disclosed. The first wave, on October 22, moved 125,029 USDT out of six wallets. The second wave, measured as of October 27, reached 272,679 USDT. Within that second wave, the firm recorded about 262,000 USDT leaving 19 wallets in a span of 34 minutes, a concentration that indicates scripted execution rather than manual withdrawals. The combined tally of 29 drained wallets counts addresses the funds left, not the number of users affected, since one user can operate several addresses.

The signature evidence is the sharpest finding: Bitquery's analysis of 33 unauthorized transfers shows each was signed with the owner key of the wallet it drained. None of the transactions called Predict.fun's market or trading contracts. Each private key signature attests that the transacting party controlled the wallet at the moment of transfer, but on-chain records alone cannot show who held those keys or how they were obtained. Tracing places part of the proceeds on a path from BNB Chain to the Ethereum network and then into Tornado Cash, a crypto mixer built to obscure the origin of funds; the investigation report records 166.8 ETH deposited into the mixer. Fund flows alone do not identify who moved the money. Roughly an hour after Predict.fun issued its statement, an additional 4,900 USDT left a different account, and the firm included that transfer in its overall total. Drains of this profile have repeated across the sector this year, including a 4.85M USDT Ethereum drain flagged by security researchers and a 15.99M USDT loss from decommissioned wallets at CoinDCX.

Owner-Key Signatures Point Away From the Protocol

Thirty-three transfers signed with individual owner keys, spread over five days and never touching the platform's contracts, argue for compromised user key material rather than a protocol-level exploit. The staggered timing weighs against a single leaked seed phrase, which would typically expose every wallet at once; per-key compromise, such as phishing, fits the record better, a pattern security researchers have documented in fake sites built to harvest USDT. What the response has changed so far is limited: the suspect documentation site is offline and a repayment pledge is on record. What it leaves open is larger: a confirmed attack vector, an account of how 29 separate keys were obtained, and any completed payouts. Predict.fun's post-mortem remains an intention, not a published outcome.