29 Predict.fun wallets lost $398K, each drain signed with the owner's own key. A first wave hit five days before the first public post
Traders on a BNB Chain prediction market woke up to missing money. We followed every transfer to learn how it left, when it really started and where it went.
- $398K
- 0 contracts
- 5 days
- 11 min
- 166.8 ETH
- 1 hour
01 · What happenedWhat happened in the Predict.fun hack
On Tuesday morning, traders on Predict.fun found money missing. One posted that about five thousand dollars was gone and that others had been hit too. Later that day, Predict.fun put the losses near $400K.
Predict.fun is a prediction market on BNB Chain. You buy shares in an outcome, like who wins a match or where bitcoin closes, and get paid if you are right. Predict.fun also runs the prediction market inside Binance Wallet.
Bitquery traced every transfer with its BNB Chain data. The record shows 29 accounts emptied of $398K in USDT, a dollar stablecoin, in two waves five days apart. Every theft was signed with the account's own owner key, the secret that controls it. No Predict.fun contract was broken. The 22 October wave took $125K, and we found no public report of it. Within two hours of each wave, nearly all the money had crossed to Ethereum and gone into Tornado Cash, a mixer that hides where coins came from. The drains did not stop when Predict.fun spoke up. One more account was hit an hour after its statement.
02 · How the accounts workHow a Predict.fun account holds your money
Your money on Predict.fun sits in a smart wallet. That is a wallet built as a small program on BNB Chain, and Predict.fun creates one for you when you sign up. Its design is Kernel, made by the wallet company ZeroDev.
A smart wallet obeys one owner key. Predict.fun's sign-in runs on Privy, a service that creates that key for each user and keeps it behind their login. Any transfer the owner key signs, the wallet carries out.
Traders who run bots use Predict.fun's API, a way to place orders from their own code. Predict.fun's own developer kit tells them to use the Privy key exported from their account. Once a key leaves the account, whoever gets a copy can do anything the owner can, including send all the money out. We have traced bot wallets drained with their own keys before, at LootBot and Bloom.
Smart wallets also pay gas, the small network fee on every action. A gas sponsor is a service that pays it for you and bills you in a token instead, here USDT.
03 · Not a contract hackNot a contract hack: the owner key signed every drain
Every drain looked the same. First, an action signed with the owner key let a gas sponsor take USDT for fees. Seconds later, a second action sent the USDT to a fresh address. That second step was the theft.
Each time, the smart wallet checked the signature as it always does. It worked out who had signed and found its own owner key. So the wallet did what its owner key told it. We checked all 33 drain transactions, and none touched a Predict.fun market or exchange contract.
The attacker's tools came from outside Predict.fun. The gas sponsor belongs to Candide, a public wallet company. So does the bundler in 28 of the 33 drains. A bundler is the service that sends these actions to the chain. Predict.fun's wallets were set up through other providers. Outside the two drain days, nobody used that sponsor at all in October. The attacker brought its own kit and needed nothing from Predict.fun's servers.
Each account had a single owner key, set when it was opened, and none was changed before the drains. Whoever did this held 29 different keys.
04 · The first waveThe first wave: 22 October
The drain everyone saw on Tuesday was the second. Five days earlier, on 22 October, the same tools hit six accounts. It began with three test transfers of a dollar or two from one account, spread over the afternoon. Then it got serious. Five more accounts were emptied in under an hour, ending with a single transfer of 82,000 USDT.
The account behind it lost $109K in two transfers, the biggest loss in this story. Less than an hour and a half later, that day's money was in Tornado Cash.
We found no public post about these drains before the second wave. Predict.fun's own total, about $400K, only adds up if it counts them, so its figure appears to include the first wave.
05 · 27 October27 October: 19 wallets in 34 minutes
The second wave opened with one small drain just after 5am UTC. Twenty minutes later the main run began. Over the next 34 minutes, 19 accounts lost $262K, about one every two minutes.
Each stolen amount went to a fresh pass-through address. Within a minute, that address sent it into Relay, a bridge that moves money between chains, and Relay paid out ETH on Ethereum seconds later. The whole trip, from the victim's account to ETH on another chain, took a minute or so each time.
All but one of those amounts was a round multiple of five dollars. Two more drains came later that morning through LI.FI, a bridge router, and Across, another bridge. One of them hit an account for the second time. The last of the morning, a small one, came just before 9am UTC.
06 · Who got hitWho got hit
All 29 accounts traded on Predict.fun in the week before they were drained. Twelve made more than a thousand trades that week, which usually means a bot. The busiest made hundreds of thousands. Five made fewer than a hundred.
Bots are a big part of prediction markets. On Polymarket, about 1 in 200 wallets trade around the clock, and they make 63% of all trades. A mix of heavy bots and light accounts fits one group best: traders who used the API, which is how bots trade. A light user who tried the API once would have exported the key just the same.
Losses ranged from a few dollars to $109K. Most were in the thousands, and the five biggest made up 73% of all the money taken.
The accounts were opened over the past ten months, the oldest in December. Two were opened just three days before they were emptied.
07 · The money trailFrom BNB Chain to Tornado Cash
On both days the money took the same road. USDT left BNB Chain through Relay, LI.FI or Across and landed on Ethereum, either as ETH or as USDT that was swapped to ETH. Then almost all of it went into Tornado Cash, which pools deposits so a withdrawal cannot be matched to the deposit behind it. We looked at that mixer in our Tornado Cash audit.
Tornado only takes fixed sizes, so the deposits came in lots. The 22 October drains put 51.8 ETH into the mixer and the 27 October drains put in 115 ETH. The one drain after Predict.fun's statement took a new exit. Its 2.08 ETH went into Railgun, another tool for hiding coins, five minutes later.
Small change stayed behind. The ETH from two small drains on Tuesday morning, a few hundredths of an ETH each, sits in two wallets of its own. Neither wallet had moved when our data ends. Both can be watched with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money goes next.
Scammers showed up too. Bots sent dust from look-alike addresses and made fake "ETH" tokens appear to leave the attacker's wallets, hoping to be copied by mistake later. That trick is address poisoning. We left those fake transfers out of every total.
08 · Faster than the alarmFaster than the alarm
On Tuesday, the first Tornado deposit came under 11 minutes after the main run began. In the first wave it took under four minutes after the biggest drain. When the first trader posted, just after 8am UTC, the last deposit of the day was already 42 minutes old.
Speed matters. A bridge or an exchange can sometimes freeze stolen money, but only if someone raises the alarm while the money is still sitting with them. In this case, the money was in the mixer before anyone knew to ask.
09 · What Predict.fun saysWhat Predict.fun says, checked against the chain
Predict.fun answered on X that afternoon. It said some of its users had lost about $400K. Its first finding is that its API documentation site, run by an outside host, may have been hacked, and the site is now offline. Predict.fun said it will "fully reimburse all affected users" and publish a full report.
The size checks out. Our two waves add up to $398K, within 1% of Predict.fun's own figure, and that only works if the company counted the first wave too.
The drains did not stop with the statement. About an hour later, at 15:42 UTC, one more account lost 4,900 USDT the same way, and that money went into Railgun. Taking the docs site down does not stop keys that were already copied.
The cause fits too. API traders put the exported owner key in their own code, and the docs are where they learn how. A hacked docs page could have run code that copied keys, or talked visitors into pasting them. Either way, it would hand over the exact key that signed each drain. That is our reading of the record. Predict.fun has not said how the site was used.
Two things are still open. Predict.fun describes a short window, yet the drains came on two days five days apart, so keys taken once may have been used twice. And the small gap that remains could be drains by another route that our trace did not catch.
10 · The first reportsChecking the first reports
The first accounts on X came within hours, from a trader who lost money, from the researcher Naeven and from the alert account Onchain Lens. Here is how they hold up.
| Source | Claim | Record | Verdict |
|---|---|---|---|
| dethective | Drained for about $5,000; names the receiving address | That address took 24,655 USDT from seven accounts, 06:01 to 06:06 UTC. Two of those drains were near $5,000 | Matches |
| Naeven | 19 victims | 19 accounts in the main run of 27 October; 29 over both waves | Right for 27 October |
| Naeven | 105 ETH, about $260K | Relay paid 112.8 ETH for those 19; 27 October took 272,679 USDT | Low |
| Onchain Lens | Predict.fun on BNB Chain likely exploited | No Predict.fun contract was called. Owner keys signed every drain | Not a contract exploit |
| Onchain Lens | About $300K moving from multiple contracts | The contracts are the victims' smart wallets. $398K over two waves | Low |
| Predict.fun | About 400,000 USDT | 397,708 USDT over two waves | Within 1% |
| Predict.fun | Its API docs site may have been hacked | The owner keys signed, and API traders hold exported keys | Fits, not proven |
11 · If you use Predict.funIf you use Predict.fun
Predict.fun says it will refund everyone who lost money. Until its full report is out, the record points to one habit worth changing. The drain after the statement shows it is urgent.
If you ever exported your Privy key, for a bot or just to try the API, treat that key as exposed. Stop using it and move your funds to a wallet whose key has never left your own device. A key that has been copied into code, a browser tab or a bot can be used by anyone who got hold of it, for as long as the wallet holds money.
12 · How we traced itHow we traced the Predict.fun hack
We started from the address in the first public post and worked outward. For every drain, we read the full call record to see which key signed and which contracts it touched. Owner keys come from the record each smart wallet writes when it is created. On Ethereum, we used Bitquery's Ethereum data to match each Relay deposit to its payout by time and price. We counted Tornado deposits from the pools' own records. Our address labels identified Relay, LI.FI, Across and Candide. Relay's public records confirmed five of the bridge moves.
The full BNB Chain and Ethereum histories are also sold as files. Bitquery does this kind of tracing for clients through its crypto investigation services. We followed the X100 hack the same way.
Transfers were read to 16:22 UTC on BNB Chain and 15:57 UTC on Ethereum on 27 October. Anything after that is not covered.
USDT counts at $1. ETH amounts are the amounts recorded on-chain.
Trade counts come from database copies that can differ slightly from each other, so treat them as approximate.
The pass-through addresses on BNB Chain may be one-time deposit addresses run by Relay. They behave the same either way.
Two more accounts got the attacker's first step on 27 October with no drain after it. They are left out of the counts.
The record shows which key signed each drain. It does not show who held that key or how it was obtained.
13 · The addressesWhere to look
These are the main wallets and transactions in this story, with the full address under each. Each one links to the explorer.
Follow the Predict.fun money in plain English
Every transfer in this story comes from Bitquery's BNB Chain and Ethereum data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the BNB Chain dataset and the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any prediction market, wallet, bridge, protocol, exchange or service.
The findings describe transactions and balances observed on BNB Chain and Ethereum between 22 and 27 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Predict.fun, Privy, ZeroDev, Candide, Relay, LI.FI, Across, Tornado Cash, Railgun, Binance, Polymarket, dethective, Naeven, Onchain Lens or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Predict.fun hacked?
Its users' wallets were. Over two waves in late October, someone used the owner keys of 29 Predict.fun accounts to take about $398K in USDT. No Predict.fun contract was broken. Predict.fun says its API documentation site may have been hacked.
How much was stolen in the Predict.fun hack?
The record shows about $398K in USDT taken from 29 accounts in two waves. That is close to Predict.fun's own figure of about $400K.
Is Predict.fun safe to use?
The drains used owner keys, and nothing in the record shows a flaw in Predict.fun's markets. Predict.fun has taken its API docs offline and promised a full report. Anyone who exported their Privy key should treat it as exposed and move their funds.
Will Predict.fun refund the victims?
Yes. Predict.fun said on X that it will fully repay every affected user for funds lost in this incident.
What happened to the Predict.fun API docs?
Predict.fun says its API documentation site, hosted by an outside provider, may have been hacked. It has taken the site offline while it investigates.
Where did the stolen money go?
It crossed from BNB Chain to Ethereum through Relay, LI.FI and Across, and 166.8 ETH went into Tornado Cash within two hours of each wave. The last drain, after Predict.fun's statement, went into Railgun instead.