Attackers exploited a vulnerability in the API documentation site of Predict.fun, a prediction market integrated into the Binance wallet app, to steal approximately $400 000 in USDT. The platform, which allows users to bet on real-world events, confirmed that the compromised site was managed by an external vendor and has since been taken offline.
The incident occurred just two days after Binance Futures introduced pre-market trading for the PREDICT token, which reached a valuation of $1,43 billion. Despite the high valuation, analysts noted that similar tokens listed by Binance typically decline by 49% within a month of their official launch. Traders are currently using up to five times leverage for these pre-market contracts.
Predict.fun has committed to fully reimbursing all affected users for their losses. While Binance does not own the platform, Predict.fun powers the prediction feature tested in the Binance wallet since March. Additionally, YZi Labs, an investment firm supported by Binance founder Changpeng Zhao, increased its stake in the project in April.
This security breach follows a similar event in June, when the rival platform Polymarket pledged to refund users after an external vendor's code led to the loss of approximately $3 million. Predict.fun has yet to disclose the total number of impacted users or provide details regarding the ownership structure of the PREDICT token.
