Incident Overview
In a troubling incident involving the prediction market platform Predict.fun, at least 19 wallets have been reported to have been siphoned of about 105 ETH, which amounts to approximately $260,000. This significant breach came to light after an individual, known on social media as dethective, reported a theft of nearly $5,000 from their own wallet on October 27. This user speculated that others might also be suffering similar financial losses linked to Predict.fun.
Investigation Findings
Following this alarming revelation, an on-chain analysis by investigator Naeven supported these claims, revealing that multiple accounts had indeed been compromised. Naeven indicated that while 19 victims were confirmed with a total loss of 105 ETH, it is plausible that additional affected wallets exist. The investigation particularly noted that the drained funds were being routed through various wallets and finally sent to Tornado Cash, a cryptocurrency mixing service that obscures transaction origins, complicating traceability.
Naeven illustrated this illicit flow of funds through a diagram, which displayed a network of victim wallets funneling assets through intermediary addresses before reaching the drainers.
Affected users have been urged by investigators to withdraw any remaining funds from Predict.fun to safeguard their assets.
Community Response
The situation escalated rapidly after the initial complaint from dethective. In their public post, they expressed concern over an apparent issue with the platform, sharing a wallet address implicated in the outflow of the stolen funds. This address was linked to suspected transfers involving significant amounts of USDT connected to the Predict.fun contract.
Methods of Attack
The exact methods used by the perpetrators to access these wallets remain unclear. However, Naeven’s investigation suggested that attackers utilized multiple intermediary accounts to gather the stolen assets before transferring them to Ethereum and eventually to Tornado Cash. The research also highlighted that some flows involved movements from the BNB Smart Chain, where Predict.fun operates, to Ethereum.
Platform Functionality and Implications
Predict.fun functions on the BNB Smart Chain, utilizing USDT as collateral for its prediction markets, where users place bets on the outcomes of future events via a system of conditional token contracts. While Naeven has confirmed the involvement of at least 19 wallets, there’s still no verified estimate of the total number of impacted users or how widespread the attack might be.
This incident reflects a growing trend in recent months, where stolen cryptocurrencies are often funneled through mixers like Tornado Cash, making it more challenging for law enforcement to track illicit funds. Earlier reports indicated similar practices involving large sums from other notable breaches in the crypto space, including a recent exploit linked to the Drift Protocol, where $109 million in Ether was moved to Tornado Cash over just two days.
As the investigation into Predict.fun continues, the potential implications for its users and the wider crypto community remain serious, underscoring ongoing vulnerabilities in decentralized platforms and the importance of securing personal digital assets.
