Protocols & Policy · Security
In an Oct. 27 company post, Predict.fun put the total at approximately 400,000 USDT across a small number of wallets, said a preliminary probe suggests its third-party-hosted API docs site may have been compromised, and pledged full reimbursement plus a post-mortem.
Predict.fun said on Oct. 27 that a small number of users experienced unauthorized transfers from their wallets totaling approximately 400,000 USDT, according to an official @predictdotfun post at about 10:33 a.m. ET [1]. That dollar figure and the "small number" framing are the company's. Le Coin has not independently verified the on-chain total or named wallet count.
The firm's preliminary investigation, in its words, "suggests that our API documentation site, which is hosted by a third-party provider, may have been compromised," and that the episode "potentially affect[ed] a small number of users over a short period of time" [1]. That is the company-alleged vector under a preliminary hedge, not a closed finding on root cause. Predict.fun said it took the API documentation site offline as a precaution and will keep it offline until the investigation is complete [1].
On remediation, the company said it "will fully reimburse all affected users for any funds lost as a direct result of this incident" [1]. It also said that once the investigation finishes, it will publish a full post-mortem detailing what happened and the steps it is taking to prevent similar incidents [1]. The post did not name the third-party host, list wallet addresses or transaction hashes, or assert a final attacker identity [1].
A fair objection is that the loss total, the scale of wallets hit, and the docs-site compromise remain company claims labeled preliminary. "May have been compromised" is the hedge Predict.fun used; readers should not treat it as proven root cause until the promised post-mortem lands [1]. Another limit is that reimbursement is a pledge in the same statement, not yet a settled payout ledger Le Coin can check [1].
What would change the view is that post-mortem: whether it confirms the third-party API docs vector, names the host and the exposure window, and shows reimbursements that match the approximately 400,000 USDT company figure [1]. Until then, the public record is the Oct. 27 statement, the offline docs site, and the reimbursement promise [1].
Holding the Corner.
Not financial advice.