Predict.fun reports unauthorized wallet transfers; research traces drains signed with owner keys
Predict.fun acknowledges about 400,000 USDT in unauthorized transfers. Bitquery traces 29 wallets across October 22 and 27 and finds owner-key signatures, not calls exploiting market contracts. A third-party API documentation compromise remains a preliminary explanation.
- Disclosed
- Oct 27, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Predict.fun smart-wallet users, especially anyone who exported a Privy owner key for API trading; the precise exposure path is unknown
- crypto
- In the wild
- Yes
- Predict.fun acknowledges unauthorized transfers; Bitquery documents actual wallet drains.
What happened
Public disclosure was on October 27, although the researcher traces activity back to October 22. Bitquery reports 397,708 USDT taken from 29 wallets over two waves; the approximate monetary scale agrees with the platform acknowledgment. The exact wallet count and trace remain researcher-reported, unverified outside that investigation. Its observation window ends on October 27.
The observed signatures establish use of owner-key authority, not how those keys were obtained. Bitquery found no market-contract calls in the drains it examined. Its proposed connection to exported owner keys used for API trading and a third-party documentation site is an explanation, not a demonstrated key-theft mechanism or evidence that Privy itself was breached. L4 reflects confirmed unauthorized transfers.
A further drain after the statement illustrates why taking a documentation site offline cannot invalidate copied keys. The research reports a reimbursement pledge, not completed refunds. This is separate from the later Binance and Polymarket incidents; no shared attacker or root cause is established.
Crime-scene timeline
Oct 22, 2026
Bitquery retrospectively identifies an earlier drain wave
Oct 27, 2026
A second wave becomes public; Predict.fun acknowledges unauthorized transfers
Oct 27, 2026
Bitquery records a further drain after the platform statement
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Predict.fun official acknowledgmentPrimaryVisible official text acknowledges about 400,000 USDT in unauthorized transfers; the documentation-provider explanation is truncated and is not treated as a proved root cause.
- Bitquery original investigationPrimaryTraces owner-key-signed drains and distinguishes wallet theft from a market-contract exploit. Counts 397,708 USDT and 29 wallets; data ends October 27, not a current final loss audit.