Predict.fun drain: no contract was broken, and that is the real lesson
Predict.fun, the BNB Chain prediction market, confirmed that about 400,000 USDT was moved out of user wallets without authorization. Its early finding points to a possibly compromised third-party API documentation site, which is now offline, and the team has promised full refunds plus a post-mortem.
On-chain tracing from Bitquery adds useful detail: 29 accounts lost about $398K across two waves (Oct 22 and Oct 27), every drain was signed with the wallet's own owner key, and none of the transactions touched a Predict.fun market contract. Most of the funds were bridged to Ethereum and pushed into Tornado Cash within hours.
My take: this was a key-handling problem, not a smart contract failure. API traders often paste exported keys into scripts, and the docs page is exactly where they learn to do it. Taking the site down does not help if a key was already copied. One more account was reportedly drained about an hour after the statement.
If you trade through any API: use dedicated low-balance keys, rotate them after incidents, and never paste a private key into a webpage.
$BNB trades around $745, roughly flat on the day, so the market is treating this as an app-level incident.
#PredictFun #BNBChain #CryptoSecurity #幣安神算子
Not financial advice.
Predict.fun, the BNB Chain prediction market, confirmed that about 400,000 USDT was moved out of user wallets without authorization. Its early finding points to a possibly compromised third-party API documentation site, which is now offline, and the team has promised full refunds plus a post-mortem.
On-chain tracing from Bitquery adds useful detail: 29 accounts lost about $398K across two waves (Oct 22 and Oct 27), every drain was signed with the wallet's own owner key, and none of the transactions touched a Predict.fun market contract. Most of the funds were bridged to Ethereum and pushed into Tornado Cash within hours.
My take: this was a key-handling problem, not a smart contract failure. API traders often paste exported keys into scripts, and the docs page is exactly where they learn to do it. Taking the site down does not help if a key was already copied. One more account was reportedly drained about an hour after the statement.
If you trade through any API: use dedicated low-balance keys, rotate them after incidents, and never paste a private key into a webpage.
$BNB trades around $745, roughly flat on the day, so the market is treating this as an app-level incident.
#PredictFun #BNBChain #CryptoSecurity #幣安神算子
Not financial advice.
