SECURITY ALERT

Nobody broke the market.

They went after the manual.

Predict.fun, a crypto prediction market, says a small number of its users saw unauthorized transfers from their wallets totalling about 400,000 USDT.

In a statement on X on Tuesday, it said its preliminary investigation “suggests” that the API documentation site, which a third-party provider hosts, “may have been compromised”.

The documentation site is offline until the investigation ends.

Predict.fun says it will fully reimburse affected users for funds lost as a direct result of the incident.

What happened, in UTC

  • Monday 26 Oct, 06:07. At a rival, Myriad, an attacker uses a compromised internal wallet to force false results on 10 markets on BNB Chain, Myriad says.
  • Minutes later. Myriad revokes the wallet’s admin rights.
  • Tuesday 27 Oct, 14:33. Predict.fun posts its statement on about 400,000 USDT in unauthorized transfers.
  • Tuesday, 16:25. Myriad publishes its incident report.

Two prediction markets in two days. Are these the same attack?

Two different doors

Nothing published so far links them.

Predict.fun has not said how a documentation site could lead to money leaving wallets. It has not said how many users were hit, or on which chain.

That gap matters. Developer docs for trading APIs often walk users through creating and pasting keys, so a tampered page could, in principle, ask for more than it should.

That is a general risk, not a finding about Predict.fun.

Myriad’s account is more detailed.

The wallet the attacker used was one Myriad relied on to create and resolve some markets automatically. Its key was exposed “several weeks ago” through a flaw in a third-party library used by a backend service, Myriad says.

The attacker bought cheap positions on unlikely outcomes, resolved the markets in their own favour and claimed the payouts, according to the report.

Myriad says the final large buy never paid out and that “the attacker withdrew nothing”.

So what do users get back?

Promised, not yet paid

Predict.fun’s reimbursement is a pledge. It has not said when payments start.

Myriad treats all 10 markets as void. Holders on both sides are to be refunded at their shares times the last price before the attack, minus any winnings already claimed from a forced result. Myriad says refunds arrive automatically, with no claim needed, and that other markets were not affected.

Portfolios may still show the wrong outcome for a while, Myriad warns.

The pattern is familiar from this week. A trading bot blamed a vendor component in Bloom’s 9,408 SOL drain through a third-party module, and a hardware wallet maker saw Foundation’s phishing emails sent through compromised Cloudflare API keys.

The pressure on prediction markets is not only technical. Regulators are fighting over who may run them at all, as in the CFTC’s suit against Utah.

What should users do now?

Protect yourself

  • If you used Predict.fun’s API documentation recently, treat any keys or wallet approvals you set up there as suspect. Revoke and regenerate them once Predict.fun says it is safe.
  • Do not paste a seed phrase or private key into any documentation page, form or chat. Our guide to what a private key is explains why no legitimate site needs it.
  • Expect fake “refund” links. Both firms say refunds come from them; Myriad says nothing needs to be claimed.
  • Keep trading balances on prediction platforms small, and move longer-term holdings to a wallet only you control.

If the weak point is a vendor’s library or a vendor’s web page, who is checking the vendors?

Corrections and new evidence: [email protected]

Related: Coinbase's vendor incident exposing some customer contact data

This article is for information only and is not investment advice.