The way predict.fun is handling this PR crisis, I can sum it up in one word: panic.
At 14:33 UTC on October 27, the official account admitted that a small number of users’ wallets had been drained without authorization, totaling around 400,000 USDT. They initially pointed the finger at a possible breach of a third-party-hosted API documentation site. X news roundups say they promised full refunds to directly affected users, took the site offline, and told everyone to withdraw their assets for now.
Up to this point, pretty standard damage control.
Then at 16:00 UTC—less than an hour and a half later—the official account posted: “Good news — you’re already earning Season 2 PP!” The final Season 1 snapshot had been taken, and Season 2 points were accruing as usual, with LP points calculated across several factors, including time spent with orders placed.
First you tell users to withdraw their funds to stay safe, then you tell them to keep placing orders to farm points. So which is it—do you want me to withdraw, or keep my orders up?
And there’s one thing I really don’t understand: how does a breach of a documentation site let someone get at the funds in users’ wallets? Was the sample code or SDK on the site altered, or did someone enter their private key there? Until the post-mortem comes out, I’m taking the “third party is to blame” claim with a grain of salt.
Refunds are the right thing to do, and following through shows accountability. But refusing to pause the points campaign even for a moment suggests the project is more afraid of TVL and activity dropping and affecting what comes next than it is of the hack itself.
Those farming points should think carefully: 400,000 is pocket change to the platform, but it’s everything to the 19 wallets that were drained.
#predictfun #Security
At 14:33 UTC on October 27, the official account admitted that a small number of users’ wallets had been drained without authorization, totaling around 400,000 USDT. They initially pointed the finger at a possible breach of a third-party-hosted API documentation site. X news roundups say they promised full refunds to directly affected users, took the site offline, and told everyone to withdraw their assets for now.
Up to this point, pretty standard damage control.
Then at 16:00 UTC—less than an hour and a half later—the official account posted: “Good news — you’re already earning Season 2 PP!” The final Season 1 snapshot had been taken, and Season 2 points were accruing as usual, with LP points calculated across several factors, including time spent with orders placed.
First you tell users to withdraw their funds to stay safe, then you tell them to keep placing orders to farm points. So which is it—do you want me to withdraw, or keep my orders up?
And there’s one thing I really don’t understand: how does a breach of a documentation site let someone get at the funds in users’ wallets? Was the sample code or SDK on the site altered, or did someone enter their private key there? Until the post-mortem comes out, I’m taking the “third party is to blame” claim with a grain of salt.
Refunds are the right thing to do, and following through shows accountability. But refusing to pause the points campaign even for a moment suggests the project is more afraid of TVL and activity dropping and affecting what comes next than it is of the hack itself.
Those farming points should think carefully: 400,000 is pocket change to the platform, but it’s everything to the 19 wallets that were drained.
#predictfun #Security