Attackers have stolen approximately $400,000 in USDT from users of Predict.fun, a prediction market integrated into the Binance Wallet application. The breach occurred just two days after Binance Futures opened pre-market futures trading for the project's unreleased token, PREDICT, at an implied valuation of $1.43 billion.
Predict.fun announced that all impacted users will receive full compensation for losses directly resulting from the breach.
API Vulnerability Traced to External Vendor
The stolen funds consisted of USDT, a dollar-pegged stablecoin. Predict.fun allows users to trade binary shares on real-world outcomes, including sports events and political elections. Preliminary investigations indicate the breach originated from a third-party application programming interface (API) documentation portal used by developers to interface with the service. The external site has since been taken offline.
Key details of the incident include:
- Total Loss: Approximately $400,000 in USDT extracted from platform users.
- Vulnerability Source: An API documentation website managed by an external vendor.
- User Protection: Predict.fun committed to fully reimbursing all affected balances.
- Pre-Market Access: Binance Futures launched PREDICT pre-market contracts featuring up to 5x leverage prior to the official token issuance.
Security compromises stemming from third-party vendors remain a persistent vulnerability across Web3 ecosystems. In June, competing prediction platform Polymarket pledged full refunds to users after an external vendor code exploit drained approximately $3 million.
Pre-Market Valuation and Exchange Ties
The exploit highlights growing scrutiny surrounding PREDICT's initial pricing. At its debut pre-market contract price, the implied valuation reached $1.43 billion, a figure analysts noted is dozens of times higher than established peers. Historical performance data across 28 prior pre-market tokens listed on Binance showed an average price decline of 49% one month after launch. Predict.fun has not yet disclosed token supply distribution data.
While Binance does not directly own Predict.fun, the protocol powers the prediction feature integrated into Binance Wallet since testing began in March. Additionally, YZi Labs, a venture firm backed by Binance founder Changpeng Zhao, expanded its investment in Predict.fun in April. The surge in embedded wallet functionality comes as users increasingly demand integrated features, mirrored by how crypto wallets pivot to in-app swaps and utility to drive retention.
Why It Matters
This incident highlights the lingering security vulnerabilities introduced by third-party infrastructure in decentralized applications, even those closely tied to major industry players like Binance. As centralized exchanges push aggressive pre-market derivatives with high leverage, retail traders face dual exposure to smart contract risks and steep valuation drawdowns. Market participants will be watching whether Predict.fun releases a complete post-mortem and detailed tokenomics breakdown before the official PREDICT token launch.
