Prediction market Predict.fun suffered approximately $397,708 in cryptocurrency theft across 29 user wallets, while blockchain security firm SlowMist separately uncovered malicious JavaScript associated with Udesk customer-support infrastructure that could steal login credentials and redirect cryptocurrency deposits.
Both developments emerged in detailed October 27, 2026 investigations and highlight the growing financial risks associated with third-party services used by cryptocurrency platforms. The incidents are unrelated, and there is no evidence connecting the attackers.
Blockchain analytics firm Bitquery traced the Predict.fun theft to two separate attack waves, including an earlier October 22 operation that had not previously been publicly identified. Meanwhile, SlowMist discovered that a modified customer-support script could collect authentication information across websites and replace cryptocurrency deposit addresses on selected trading platforms.
The findings illustrate how attackers can compromise user assets without exploiting the underlying blockchain protocols or trading smart contracts.
Predict.fun Loses $397,708 Across Two Attack Waves
According to Bitquery’s original on-chain investigation, attackers drained 397,708 USDT from 29 Predict.fun smart wallets on BNB Chain between October 22 and October 27.
The first wave occurred on October 22, when six accounts lost a combined 125,029 USDT. The activity began with several small test transfers before escalating into larger withdrawals, including a single transaction worth 82,000 USDT.
The second wave began shortly after 05:00 UTC on October 27 and accounted for another 272,679 USDT. During the main attack sequence, 19 wallets lost approximately $262,000 within 34 minutes.
Bitquery identified 33 drain transactions and found that every unauthorized withdrawal was signed using the affected wallet’s own signing key. None of those transactions interacted with Predict.fun’s market or exchange contracts.
That distinction indicates that the attacker possessed valid authorization credentials rather than exploiting a vulnerability in the prediction market’s trading contracts.
The affected accounts used smart-wallet technology associated with ZeroDev and authentication infrastructure provided by Privy. Predict.fun’s API documentation instructed developers using automated trading systems to export the relevant wallet key, creating a potential exposure if those credentials were subsequently compromised.
Predict.fun acknowledged unauthorized transfers totaling approximately 400,000 USDT in its October 27 security statement.
The platform said its preliminary investigation suggested that an externally hosted API documentation website may have been compromised. It took the documentation site offline and committed to fully reimbursing users who suffered direct losses.
However, the precise method by which the attacker obtained the signing keys remains unconfirmed. The suspected documentation-site compromise has not been established as the definitive cause, and the reimbursement pledge does not establish that payments have already been distributed.
Stolen Funds Move Through Tornado Cash and Railgun
Bitquery’s transaction tracing revealed that the stolen funds were rapidly transferred from BNB Chain to Ethereum using cross-chain infrastructure, including Relay, LI.FI and Across.
The attacker converted the proceeds into ETH and deposited approximately 166.8 ETH into Tornado Cash, a cryptocurrency privacy protocol that makes transaction tracing more difficult by separating deposits from subsequent withdrawals.
The October 22 thefts accounted for 51.8 ETH deposited into Tornado Cash, while the October 27 activity contributed another 115 ETH.
Some funds reached Ethereum within approximately one minute of leaving the victims’ wallets. The first Tornado Cash deposit following the October 27 main attack occurred in less than 11 minutes.
Importantly, the activity continued after Predict.fun publicly acknowledged the security incident.
At approximately 15:42 UTC on October 27, roughly one hour after the official disclosure, another wallet lost 4,900 USDT. Those funds were converted into approximately 2.08 ETH and transferred into Railgun, another privacy-focused cryptocurrency system.
This later transaction forms part of the documented attack activity rather than a separate, additional loss to be added to Bitquery’s $397,708 total.
The post-disclosure withdrawal also suggests that disabling a potentially compromised website would not necessarily prevent further losses if the attacker had already obtained usable signing keys.
Bitquery’s findings therefore raise questions about how long the credentials remained exposed, when the first compromise occurred and whether the platform could identify vulnerable wallets before additional withdrawals took place.
SlowMist Finds Malicious Code in Udesk Support Scripts
In a separate October 27 technical disclosure, SlowMist identified malicious JavaScript associated with Udesk, a customer-support system embedded in third-party websites.
The researchers examined a modified script named udeskApi.2026-10-16.cached.js, which contained an additional loader capable of downloading a second malicious file called deeps.js.
The payload was hosted on the deceptive domain udeskqlobal[.]com, which resembles a legitimate global service address but substitutes the letter q for g.
SlowMist found that the malicious script could collect accessible cookies, localStorage, sessionStorage and sensitive information transmitted through authentication forms and login requests.
Such information could potentially enable attackers to impersonate users or hijack authenticated sessions.
The code also contained a targeted cryptocurrency-deposit manipulation component affecting websites identified as MGBX, Biking Exchange and BitxEX.
On matching deposit pages, the payload repeatedly searched for cryptocurrency addresses and replaced them with attacker-controlled destinations across Bitcoin, Ethereum-compatible networks, TRON, Solana, Litecoin and Dogecoin.
The script also intercepted clipboard operations, meaning users copying a deposit address could receive the same fraudulent address displayed on the compromised page.
This creates an especially dangerous scenario because customers may believe they have verified the destination by comparing the displayed and copied addresses, even though both have been manipulated.
SlowMist emphasized that the credential-collection component was broader than the exchange-specific address replacement. Websites loading the affected script could potentially expose session information even when their domains did not match the three targeted trading platforms.
The firm recommended removing compromised scripts, investigating possible information exposure, revoking sessions, rotating credentials and verifying transaction destinations against trusted records.
Nevertheless, investigators have not established how the script was modified, whether Udesk’s central infrastructure was compromised or how many customers encountered the malicious code. No independently verified victim count or stolen-fund total has been disclosed for this campaign.
Third-Party Security Weaknesses Threaten Crypto Investors
Although the Predict.fun theft and the Udesk JavaScript findings involve different attack methods, both expose a fundamental vulnerability in cryptocurrency infrastructure: external services can become pathways to financial losses even when blockchain contracts operate correctly.
Predict.fun demonstrates the consequences of compromised wallet credentials. Smart wallets can enforce authorization rules correctly while still processing fraudulent transfers if an attacker obtains the legitimate signing key.
For prediction markets, this risk may be particularly relevant because automated trading participants frequently use APIs and software integrations to execute transactions. The convenience of automated access can increase the number of environments where sensitive credentials are stored.
SlowMist’s discovery highlights a different problem. Third-party scripts embedded in trading websites can operate with access to sensitive browser information, potentially undermining security measures implemented elsewhere in the application.
For exchanges and cryptocurrency businesses, the implications extend beyond immediate financial losses. Compromised authentication systems can produce account-takeover risks, disputed deposits, customer-support costs and reputational damage.
The speed of the Predict.fun laundering activity creates an additional challenge for recovery efforts. Once stolen assets have crossed networks and entered privacy protocols, tracing and recovering them becomes significantly more difficult.
That makes early detection, rapid credential revocation and effective monitoring particularly important. In this case, the previously unidentified October 22 withdrawals also raise questions about how quickly suspicious activity can be recognized across multiple user accounts.
For Predict.fun, the next developments to watch include publication of its promised post-mortem, confirmation of the initial compromise mechanism, the scope of exposed credentials and progress toward reimbursing affected customers.
For Udesk-related infrastructure, the priorities include identifying where the malicious scripts were distributed, determining whether customer information was actually exfiltrated and establishing whether cryptocurrency deposits were redirected to attacker-controlled addresses.
Neither investigation establishes that all users of the affected services were compromised. However, both show why cryptocurrency security cannot depend exclusively on smart-contract audits or blockchain-level protections.
As trading platforms increasingly integrate third-party authentication, developer tools and customer-support services, the security of those external components will remain central to protecting customer assets and maintaining investor confidence.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574