Attackers withdrew about $400,000 from users of Predict.fun — a prediction market built into the Binance wallet. The attack occurred just two days after Binance opened trading in the project's token at a valuation of $1.43 billion.
The affected funds were held in USDT stablecoins. Predict.fun allows users to buy "yes" or "no" shares on real-world events — elections, football matches, and other outcomes. The team did not disclose the exact number of affected users.
Attack vector: a vulnerability in the API documentation
According to the company's preliminary version of events, the weak point was the software interface (API) documentation — a page with instructions for developers on connecting to the platform. It was maintained by a third-party company, and it is currently unavailable.
"We will fully reimburse all affected users for any funds lost directly as a result of this incident," the project team stated.
There are precedents: in June, competitor Polymarket promised a full refund of client funds after attackers withdrew about $3 million due to third-party code.
The $1.4 billion valuation raises questions
The hack occurred two days after Binance Futures launched trading in PREDICT — the Predict.fun token. In presales, such contracts allow traders to speculate on a token before its issuance with leverage of up to 5x.
Analysts, meanwhile, believe the $1.43 billion valuation is excessively inflated. "At the current price, its valuation is $1.43 billion… that is dozens of times higher than its peers," one analyst notes. A study of 28 previous tokens launched by Binance in this manner showed that a month after launch, most of them fell by 49%. Predict.fun has not yet disclosed who owns PREDICT and how much.
What Binance has to do with it
Binance does not own the platform, but Predict.fun is the company behind the predictions tab that the Binance wallet began testing in March. YZi Labs — the investment firm backed by Binance founder Changpeng Zhao — also increased its stake in the project.
Cryptalist analysis: The incident exposes a systemic problem in prediction markets — dependence on third-party contractors for critical infrastructure components, which makes them vulnerable even when the core is formally reliable. For the Binance ecosystem, reputational risks are amplified against the backdrop of PREDICT's inflated valuation and the statistics on the decline of similar listings, which requires investors to exercise heightened caution when dealing with presale-contract tokens.