The Predict.fun Hack Explained: A Third-Party Docs Site

By Owen Thurm Published November 6, 2026 4 min read

Quick answer. On October 27, 2026, Predict.fun reported about 400,000 USDT in unauthorized wallet transfers. Its preliminary investigation suggests its third-party-hosted API docs site may have been compromised. How is unconfirmed; the lesson so far is to watch vendor-hosted pages.

Watch: The Predict.fun Hack Explained: A Third-Party Docs Site 1:43

Video transcript

On October 27, Predict.fun users found their wallets drained. The preliminary lead is a site the team does not host, its API docs.

At 8:08 UTC, a user on X reported a drained wallet. By 9:46, investigator Naeven counted 19 victims and about 105 ETH, sent on to Tornado Cash. At 14:33, Predict.fun confirmed the losses.

The team put the loss at about 400,000 USDT and promised full reimbursement. As of November 6, we found no post-mortem and no confirmation refunds were complete.

Predict.fun said its API docs site, hosted by a third-party provider, may have been compromised. It took the site offline as a precaution.

Still unexplained are the provider, how long the site was compromised, how a docs site led to wallet transfers, and whether any contract or the main app was involved.

A docs site carries the team's name, and developers copy code from it. That same week, Polymarket said a vendor's script on its site was replaced.

Every hosted page, vendor platform, DNS record and vendor login needs an owner and a watch. And keep a way to pull a site fast.

Guardian's Managed Security covers frontends, domains and DNS around the clock. Within it, Shield tests everything exposed. Sentry watches domains, DNS and certificates, and a WebApp Pentest covers the client side.

Read the full explainer, or talk to Guardian about putting every hosted surface in scope.

Predict.fun is a prediction market on BNB Chain. On the morning of October 27, users on X began reporting drained wallets.

By the afternoon, Predict.fun had confirmed losses. Its preliminary investigation pointed to a site it does not host itself: its API documentation.

This explainer sets out what the team and onchain analysts have said, and what is still open. All times are UTC.

What Happened

At 08:08, an X user posted that about $5,000 had been drained from their wallet an hour earlier. They said other victims also seemed linked to Predict.fun.

At 09:46, onchain investigator Naeven said they had found 19 victims drained of about 105 ETH, roughly $260K, and that there were likely more.

Naeven said the funds were bridged to Ethereum and sent on to Tornado Cash. They urged users with funds on the platform to move them out.

At 14:33, Predict.fun confirmed "unauthorized transfers of funds" from the wallets of "a small number of users," totaling about 400,000 USDT.

It said its API documentation site, "hosted by a third-party provider, may have been compromised." It took the site offline as a precaution.

What Is Known About the Attack

Predict.fun has described the cause only in preliminary terms. Here is what its statement does and does not say.

Stated by Predict.fun

Funds left users' wallets in transfers the users did not authorize.
About 400,000 USDT was affected, across a small number of users.
A third-party provider hosts its API documentation site.
That site may have been compromised, potentially affecting a few users over a short period.
The site would stay offline until the investigation was complete.

Not yet explained

Which provider hosts the docs site.
How the site was compromised, and for how long.
How a docs site led to transfers from user wallets.
Whether any contract or the main app was involved.

Before the statement, crypto.news reported that investigators had not determined whether compromised permissions, malicious signatures or a vulnerable contract were behind the drain.

Predict.fun has promised a full post-mortem. This explainer goes no further than the team's statement until that appears.

Timeline and Loss

When (UTC, Oct 27)	Event
08:08	An X user reports about $5,000 drained an hour earlier
09:46	Naeven counts 19 victims and about 105 ETH (~$260K)
13:44	crypto.news reports a suspected wallet drain
14:33	Predict.fun confirms about 400,000 USDT; docs site may be the cause

The figures come from different counts at different times. Naeven's early count covered 19 wallets and said more victims were likely.

Predict.fun's own figure is about 400,000 USDT. Its statement gave no victim count beyond "a small number of users."

It said it "will fully reimburse all affected users for any funds lost as a direct result of this incident."

As of November 6, we found no published post-mortem and no public confirmation that refunds were complete.

What It Shows

In the same week, two prediction markets pointed to a third party. On October 29, Polymarket said a vendor's script on its site had been replaced.

A docs site carries the team's name and sits a click from the app. Developers copy code, endpoints and setup steps from it.

That makes it part of the web surface, even when a vendor runs it. Each of these needs an owner and a watch:

Every hosted page. Docs, status pages and help centers carry the team's name.
Every vendor platform. A page a provider runs for you is still your page to users.
Every DNS record. Each record pointing to a vendor needs an owner and a review date.
Every vendor login. Require SSO and hardware-key MFA on docs and hosting accounts.
A way to pull a site fast. Predict.fun took its docs offline as a precaution.

For the wider risks in this sector, read prediction market security. For a vendor compromise traced in detail, see the Polymarket script attack.

If your own wallet was drained, start with what to do after a wallet drain.

How Guardian Covers This Surface

Guardian's Managed Security lists frontends, and domains and DNS, among the surfaces it covers around the clock.

Within it, Shield is Guardian's continuous coverage of everything a team has facing the internet. It tests everything exposed, around the clock.

Shield needs no special access from the team, and a Guardian researcher verifies what it finds.

Offchain, Guardian's Sentry watches domains, DNS, certificates, cloud and code host. When something fires, a Guardian engineer responds.

For the app itself, a WebApp Pentest covers authentication, value-moving flows and the client-side surface, including bundle supply chain.

Frequently Asked Questions

What happened in the Predict.fun hack?

On October 27, 2026, Predict.fun reported about 400,000 USDT in unauthorized transfers from a small number of users' wallets. Its preliminary investigation suggests its third-party-hosted API docs site may have been compromised, potentially affecting users over a short period.

How did a docs site lead to stolen funds?

Predict.fun has not said. Its statement links the losses to the docs site only as a preliminary finding and promises a full post-mortem. Until that appears, the mechanism is unconfirmed.

Will Predict.fun users be refunded?

Predict.fun said it will fully reimburse all affected users for any funds lost as a direct result of the incident. As of November 6, 2026, we found no public confirmation that refunds were complete.

Where did the stolen funds go?

Onchain investigator Naeven said the funds were bridged to Ethereum and forwarded to Tornado Cash. Naeven's early count found 19 victims and about 105 ETH, roughly $260K.

Sources

Put every hosted surface in scope

Guardian's Shield finds everything you expose to the internet and tests it around the clock.

Talk to Guardian Explore Managed Security