Predict.fun reports ~400k USDT in unauthorized transfers, suspects API documentation site compromise.
Security & Exploits ·
Predict.fun disclosed approximately 400,000 USDT in unauthorized transfers and indicated that its API documentation site may have been compromised. The incident points to a potential security breach affecting developer-facing infrastructure, a category of attack surface increasingly targeted in crypto ecosystems.
API documentation portals serve as critical touchpoints where developers integrate with protocols and where automated systems—including AI-driven tools—fetch instructions on how to interact with smart contracts and node interfaces. Compromise of such a site can expose credentials, API keys, or allow injection of malicious code into workflows that rely on those specifications. The scale of unauthorized movement suggests either direct fund extraction via compromised keys or exploitation of integration trust relationships.
What remains unclear is whether the breach was limited to credential exposure, whether user funds held in contracts were directly siphoned, the timeline of the compromise, or what remediation steps Predict.fun has taken. No statement on whether affected users will be compensated has been reported.