Predict.fun reports unauthorized wallet transfers; research traces drains signed with owner keys
Predict.fun acknowledges about 400,000 USDT in unauthorized transfers. Bitquery traces 29 wallets across October 22 and 27 and finds owner-key signatures, not calls exploiting market contracts. A third-party API documentation compromise remains a preliminary explanation.
- Disclosed
- Oct 27, 2026
- Updated Nov 7, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Predict.fun smart-wallet users, especially anyone who exported a Privy owner key for API trading; the precise exposure path is unknown
- crypto
- In the wild
- Yes
- Predict.fun acknowledges unauthorized transfers; Bitquery documents actual wallet drains.
What happened
Public disclosure was on October 27, although the researcher traces activity back to October 22. Bitquery reports 397,708 USDT taken from 29 wallets over two waves; the approximate monetary scale agrees with the platform acknowledgment. The exact wallet count and trace remain researcher-reported, unverified outside that investigation. Its observation window ends on October 27.
The observed signatures establish use of owner-key authority, not how those keys were obtained. Bitquery found no market-contract calls in the drains it examined. Its proposed connection to exported owner keys used for API trading and a third-party documentation site is an explanation, not a demonstrated key-theft mechanism or evidence that Privy itself was breached. L4 reflects confirmed unauthorized transfers.
A further drain after the statement illustrates why taking a documentation site offline cannot invalidate copied keys. The research reports a reimbursement pledge, not completed refunds. This is separate from the later Binance and Polymarket incidents; no shared attacker or root cause is established.
SEAL’s November 4 incident-response roundup describes an injected script on a taken-over third-party API documentation site. This adds an incident responder’s account of the delivery channel. It does not specify how the site was taken over, how the script obtained each signing key or whether the operator completed reimbursement. The reported $400,000 describes the same incident and is not an additional amount.
Crime-scene timeline
Oct 22, 2026
Bitquery retrospectively identifies an earlier drain wave
Oct 27, 2026
A second wave becomes public; Predict.fun acknowledges unauthorized transfers
Oct 27, 2026
Bitquery records a further drain after the platform statement
Nov 4, 2026
SEAL reports injected code on a third-party documentation site
SEAL associates the documentation-site takeover and script injection with a reported $400,000 loss.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Predict.fun official acknowledgmentPrimaryVisible official text acknowledges about 400,000 USDT in unauthorized transfers; the documentation-provider explanation is truncated and is not treated as a proved root cause.
- Bitquery original investigationPrimaryTraces owner-key-signed drains and distinguishes wallet theft from a market-contract exploit. Counts 397,708 USDT and 29 wallets; data ends October 27, not a current final loss audit.
- Security Alliance incident-response roundupPrimaryAttributes the incident to script injection after a third-party API documentation site takeover and reports approximately $400,000 in losses.