BTC $80,199 
ETH $2,329 
MGLOEURO $111,813 
USDT $0.9988 
BNB $743.69 
XRP $1.31 
USDC $0.9994 
SOL $100.39 
TRX $0.3275 
FIGR_HELOC $1.03 Hacks & Security · Explained
Predict Fun users lose $260K in suspected ongoing wallet drain
Investigators identified at least 19 affected wallets on the BNB prediction market platform, with stolen funds traced to Tornado Cash.
Key takeaways
- Scale unclear. While investigators identified 19 affected wallets totaling 105 ETH in losses, analysts warned that the actual number of compromised accounts may be significantly higher.
- Attack vector unknown. Researchers have not yet determined whether the incident involved compromised wallet permissions, malicious token approvals, or a vulnerable smart contract.
- Funds obfuscated. The stolen cryptocurrency was routed through multiple intermediary addresses across BNB Chain and Ethereum before reaching Tornado Cash, making further tracking difficult.
What happened
A suspected wallet draining incident targeting the BNB-based prediction market Predict Fun has resulted in losses of approximately $260,000 across at least 19 user addresses. On-chain investigator Naeven reported the incident on October 27 after a user known as Dethective disclosed unauthorized withdrawals from their account totaling roughly $5,000. Dethective's public disclosure of the breach prompted broader investigation into whether other platform users had experienced similar unauthorized fund transfers.
Naeven's subsequent analysis identified a coordinated pattern of fund movements originating from multiple Predict Fun user wallets. The investigator traced approximately 105 ETH flowing from these compromised addresses through intermediary wallets before ultimately reaching the cryptocurrency mixer Tornado Cash. Transaction mapping showed funds being transferred across both BNB Chain and Ethereum networks, with some assets bridged between the two blockchains as part of the exfiltration process. Naeven cautioned that the 19 wallets identified represent a confirmed minimum and that additional affected users may not yet have discovered the unauthorized withdrawals.
Despite the coordinated nature of the draining activity, investigators have not established the specific attack vector used to compromise the affected wallets. The precise cause remains unclear, with several possibilities still under consideration including compromised wallet permissions, malicious token signatures granting unauthorized spending access, or vulnerabilities in the platform's smart contracts. Neither the method of initial compromise nor the identity of the attacker has been publicly disclosed.
Why it matters
The incident highlights ongoing security risks for users of cryptocurrency platforms even as the broader ecosystem continues development. Users who retain funds on Predict Fun face potential additional losses if the vulnerability remains unpatched, prompting Naeven to issue an urgent warning for platform users to withdraw their assets. The scale of the incident and indication that more wallets may be affected underscores the importance of understanding one's exposure to platform-level security risks versus self-custody alternatives.
Background
Predict Fun operates as a decentralized prediction market platform on BNB Smart Chain, enabling users to trade positions based on outcomes of future events. Founded by former Binance staff, the platform was backed by Binance founder Changpeng Zhao and incubated by YZI Labs, formerly known as Binance Labs. The platform uses USDT as collateral and manages user positions through conditional token contracts that handle market settlements and redemption transactions. According to crypto tracker DefiLlama, Predict Fun generated just over $9 million in fees during 2026.
What to watch
The use of Tornado Cash to obfuscate the stolen funds aligns with a recent pattern observed in other major cryptocurrency thefts. Crypto.news previously reported that attackers involved in the Drift Protocol exploit transferred approximately $109 million in Ether through Tornado Cash, while the Triple-A treasury breach similarly resulted in $12.4 million being routed through the same mixing service. These incidents demonstrate how mixers continue to serve as a final destination for stolen cryptocurrency despite regulatory scrutiny.
Questions readers ask
How many Predict Fun users were affected?
Investigators identified at least 19 compromised wallets, though analysts believe the actual number of affected users may be higher. Predict Fun has not yet disclosed the total number of impacted accounts or the total loss amount.
How was the attack carried out?
The specific attack method remains unknown. Investigators have not yet determined whether the incident involved compromised wallet permissions, malicious token approvals granting unlimited spending access, or vulnerabilities in Predict Fun's smart contracts.
What should Predict Fun users do?
Investigators recommended that users with remaining funds on the platform move their assets to self-custody or another secure location. Users who believe their accounts may have been affected should review their recent transaction history and check for unauthorized withdrawals.
