Predict.fun says it will fully reimburse users after confirming unauthorised transfers totalling approximately 400,000 USDT from a small number of wallets.
The BNB Chain prediction market said its preliminary investigation had identified a possible compromise of a third-party API documentation website. The platform has taken the externally hosted site offline while it examines the incident.
In a statement on 27 October, Predict.fun said the suspected breach may have lasted only a short period. It did not identify the provider hosting the documentation site or explain how access to users’ funds may have been obtained.
The documentation platform will remain unavailable until the investigation is complete, with no date given for its return. Predict.fun said its reimbursement commitment covers losses directly linked to the incident and promised to publish a full post-mortem, including the cause of the breach and measures intended to prevent a repeat.
API tools had supported trading and account access
Predict.fun launched a self-service developer dashboard on 1 September. The portal allowed developers to create applications, generate API keys, import existing keys and monitor usage limits without depending entirely on support staff.
Previously, developers seeking an API key had been directed to Predict.fun’s Discord server to open a support ticket. The platform described its REST API as a beta product and asked users to report problems through the same channel.
The documentation covered tools for submitting and cancelling individual orders, as well as cancelling groups of orders. Developers could also access market data, order books, account activity and user positions, while WebSocket connections provided live information.
When the dashboard was introduced, Predict.fun said new applications would have controls limiting bursts of order-creation and cancellation requests enabled by default. Existing applications would receive the controls when their owners next requested a rate-limit adjustment.
Binance Wallet integration and investment
On 9 April, Binance Wallet announced in-app access to prediction markets through Predict.fun. The integration allowed users to access the service through the Binance app, while trades were executed using Predict.fun’s smart contracts.
Predict.fun continued to operate the events, pricing and settlement rules. Eligible users could take positions on sports, economics, world events and crypto, with contracts settled under the platform’s rules.
Users could trade with balances held in their spot and funding accounts, while Binance Wallet covered trading and settlement gas fees. The service was described as a third-party integration available to eligible users.
On 2 April, YZi Labs announced a follow-on investment in Predict.fun involving Susquehanna Crypto, the digital-asset arm of Susquehanna International Group. At the time, the companies said the platform had recorded more than $1.8 billion in cumulative trading volume and processed more than 4 million orders since its December 2025 launch.
YZi Labs described Predict.fun as a self-custodial product offering gasless transactions and yield on collateral backing open positions. In an explanation published on 15 July, Predict.fun said eligible markets route USDT collateral through Venus Protocol, with interest calculated using on-chain position snapshots and distributed weekly.
The platform takes a 10% management fee from earned yield. It said the rate is variable and depends on utilisation of Venus’s USDT pool. Only markets marked with a Yield badge participate, and Predict.fun monitors pool utilisation before launching additional yield-bearing markets.
The company also warned that a liquidity shortage at Venus could temporarily delay claims on winnings. It said it could withdraw funds from Venus, convert affected markets to non-yield-bearing markets and pause the creation of new yield-bearing markets if necessary.
Polymarket reported a separate vendor breach
In June, Polymarket disclosed a separate incident involving a compromised third-party vendor. On 25 June, it said an attacker had used the breach to insert a malicious script into its frontend for some users.
Polymarket said it contained the incident, removed the affected dependency and contacted users to refund their losses in full. Blockchain analyst Specter estimated losses of $2.94 million across at least 11 wallets in coverage published on 26 June.
Specter said funds had been taken from wallets holding PUSD, converted into ETH and combined in a receiving address. The analyst described the incident as a phishing attack involving users who interacted with the compromised interface.
