Protocols & Policy · Security
Predict.fun says about 400,000 USDT moved in unauthorized transfers
In an Oct. 27 company post, Predict.fun put the total at approximately 400,000 USDT across a small number of wallets, said a preliminary probe suggests its third-party-hosted API docs site may have been compromised, and pledged full reimbursement plus a post-mortem.
Predict.fun said on Oct. 27 that a small number of users experienced unauthorized transfers from their wallets totaling approximately 400,000 USDT, according to an official @predictdotfun post at about 10:33 a.m. ET [1]. That dollar figure and the "small number" framing are the company's. Le Coin has not independently verified the on-chain total or named wallet count.
The firm's preliminary investigation, in its words, "suggests that our API documentation site, which is hosted by a third-party provider, may have been compromised," and that the episode "potentially affect[ed] a small number of users over a short period of time" [1]. That is the company-alleged vector under a preliminary hedge, not a closed finding on root cause. Predict.fun said it took the API documentation site offline as a precaution and will keep it offline until the investigation is complete [1].
On remediation, the company said it "will fully reimburse all affected users for any funds lost as a direct result of this incident" [1]. It also said that once the investigation finishes, it will publish a full post-mortem detailing what happened and the steps it is taking to prevent similar incidents [1]. The post did not name the third-party host, list wallet addresses or transaction hashes, or assert a final attacker identity [1].
The objection
A fair objection is that the loss total, the scale of wallets hit, and the docs-site compromise remain company claims labeled preliminary. "May have been compromised" is the hedge Predict.fun used; readers should not treat it as proven root cause until the promised post-mortem lands [1]. Another limit is that reimbursement is a pledge in the same statement, not yet a settled payout ledger Le Coin can check [1].
The tell
What would change the view is that post-mortem: whether it confirms the third-party API docs vector, names the host and the exposure window, and shows reimbursements that match the approximately 400,000 USDT company figure [1]. Until then, the public record is the Oct. 27 statement, the offline docs site, and the reimbursement promise [1].
Sources
- Predict.fun (@predictdotfun), X statement, Oct. 27, 2026, ~10:33 a.m. ET (created_at 2026-10-27T14:33:39.000Z; status 2115089547528950108), https://x.com/predictdotfun/status/2115089547528950108 ; unauthorized transfers totaling approximately 400,000 USDT; preliminary investigation suggests third-party-hosted API documentation site may have been compromised; site taken offline as a precaution; full reimbursement of funds lost as a direct result; full post-mortem forthcoming; accessed Oct. 27, 2026, ~1:30 p.m. ET.
Holding the Corner.
Not financial advice.