Iris
News

Drain

predict.fun accounts drained of 267,568 USDT on BNB Chain

267,568 USDT from 20 accounts

20 predict.fun smart accounts were drained in 48 minutes, each signed with the user's own key. Iris traced the USDT through Relay to Ethereum and 115 ETH into Tornado Cash.

BNB ChainEthereumCashed out
Open the live board

Key facts

Amount
267,568 USDT from 20 accounts in 21 txs (05:31 to 06:19 UTC); 115 ETH into Tornado Cash
Victims
20 predict.fun smart accounts (ZeroDev Kernel v3.1) on BNB Chain
Date
Oct 27, 2026
Where the funds are
As of Oct 27: 115 ETH is in Tornado Cash (16 deposits, last at 07:26 UTC). About 0.37 ETH is left in four attacker wallets on Ethereum. The BNB Chain drainers hold 0 BNB and about 0.016 USDT each.
Freezable
Nothing: every drainer bridged its USDT to ETH through Relay within about 40 seconds, and the ETH went into Tornado Cash. The 0.37 ETH left is native ETH.
Addresses
  • 0x0299b21d5a285e3ee5505c12299b4e33d3bab102BNB Chain, drainer, 60,500 USDT
  • 0xcd34891c7fc9299f86da30e4797232ae6f4f685cBNB Chain, drainer, 53,700 USDT
  • 0xbe754caab768f114b1d610982dfe981e13fc83b8BNB Chain, drainer, 50,510.01 USDT from 4 accounts
  • 0x002c755b902dfc0fff94bb5ba05789d8ead8a2e4BNB Chain, drainer, 41,000 USDT
  • 0x8b001d7378dbc19c1c62e39c0fc9ffad84182fbaBNB Chain, drainer, 24,655 USDT from 7 accounts
  • 0x435f8c80de1190a96adf625532faab76b24fb2d4BNB Chain, drainer, 23,815 USDT from 3 accounts
  • 0x31383cec40efc929f293c4cf54e29219b70076e9BNB Chain, drainer, 7,415 USDT from 2 accounts
  • 0x93cebeed24f09a4d7038ae65c12b0c96472ebf95Ethereum, received 5,972.70 USDT via LI.FI and Across
  • 0x294dc89990f70ddb3067b0a8c917413a3e8d7c13Ethereum, Relay output, 10 ETH into Tornado Cash
  • 0x44870558ef468eaf3caef7c802945a6697ec30a5Ethereum, 3 x 1 ETH into Tornado Cash, 0.1862 ETH left
  • 0x3c9f6411cd1fbefaf33397145514ed2bf662eef9Ethereum, Relay output, 10.2786 ETH
  • 0xd500a43442253a4b92a025f6604df2dd57d78e6fEthereum, Relay output, 0.0172 ETH left
  • 0x5b51e000f08eeaf34484ea6b7e16f536773fe4eeEthereum, Relay output, 23.1749 ETH
  • 0x93b94f8db5655064f35b2cbc5b8e37e34443747cEthereum, Relay output, 0.1357 ETH left
  • 0x85cd3ee47307bcaf9e1ada4230cc7646e603d429Ethereum, Relay output, 0.0320 ETH left

Updates

  1. An affected API user posts that the team found the root cause, related to the documentation, and refunded him.

  2. predict.fun says its third-party-hosted API documentation site may have been compromised, and promises full reimbursement and a post-mortem.

What happened

On Oct 27, 2026, 20 predict.fun accounts on BNB Chain were drained of 267,568 USDT in 48 minutes. predict.fun is a prediction market on BNB Chain. At 14:33 UTC it said its API documentation site, hosted by a third-party provider, may have been compromised, and promised full reimbursement and a post-mortem.

No contract was hacked

Every victim is a predict.fun smart account (ZeroDev Kernel v3.1). Each drain was signed by that account's own owner key, a different key for each victim, and no owner was changed. The attacker could sign with each user's own key.

predict.fun's docs tell API users to sign in with their Privy wallet private key, exported from the account settings. That would explain how the keys leaked, but it is not visible on chain.

Same script on every account

  1. Approve the gas paymaster for unlimited USDT.
  2. Seconds later, send a round amount, nearly the whole balance.

19 of the 20 accounts held no BNB, so the attacker paid gas with the stolen USDT. The money went to 7 fresh addresses with 0 BNB, plus 2 transfers through LI.FI and Across.

Timeline (UTC, Oct 27)

  • 05:31 first drain
  • 05:41 first 10 ETH into Tornado Cash
  • 06:05 last direct drain (4,845 USDT)
  • 06:19 last transfer, through LI.FI and Across
  • 07:26 last Tornado Cash deposit

The money

Each drainer bridged through Relay 20 to 40 seconds after its drain: 261,595 USDT became 112.8 ETH on Ethereum. Another 5,973 USDT went through LI.FI and Across and was swapped to ETH on Uniswap. Then 16 deposits into Tornado Cash (11 into the 10 ETH pool, 5 into the 1 ETH pool): 115 ETH. About 0.37 ETH is left.

The largest single drains were 60,500 USDT (to 0x0299...b102) and 53,700 USDT (to 0xcd34...685c).

The gap

predict.fun says about 400,000 USDT. Iris scanned BNB Chain from 02:32 to about 16:30 UTC on Oct 27 and found 267,567.72 USDT from 20 accounts. Three more same-shape transfers (5,111 USDT) are not counted because they are not confirmed as drains.

One account on X claimed earlier waves on Oct 14/15 and Oct 22 and named 11 addresses as drainers. On chain, all 11 are predict.fun-style smart accounts with the same Kernel implementation as the victims, so they look like accounts, not drainers. The Oct 22 batch is unclear; the Oct 14/15 batch does not match the Oct 27 pattern. Neither wave is confirmed.

What to do

If you used predict.fun's API with your Privy key, treat that key as burned and move what's left to a new wallet. predict.fun says it will fully reimburse affected users. If your own wallet was drained, start at /drained.

Full board: /explorer/predictf-unoct27drain

Every investigation