BNB Chain prediction-market platform Predict Fun is facing a possible security incident after blockchain-monitoring account Onchain Lens flagged approximately $300,000 in suspicious transfers associated with multiple smart contracts on October 27. The researcher described a route through intermediary addresses and the cross-chain service Relay, with funds reportedly moving to another network before reaching Tornado Cash.
The findings are an early warning rather than a confirmed account of money stolen from customers. Neither a complete set of transaction hashes nor a technical explanation of how the funds left the relevant contracts accompanied the initial public alert. A search of Predict Fun’s published announcements did not identify an official incident report confirming the amount, the affected contracts or a vulnerability at the time of this report.
That uncertainty is material for traders. Transfers from addresses associated with a platform can be suspicious without proving an exploit: the distinction depends on whether the contracts were expected to release funds, who controlled the receiving addresses, and whether the transactions violated the protocol’s intended accounting and authorization rules.
What Did Onchain Lens Report About Predict Fun?
In an October 27 alert, Onchain Lens described Predict Fun on BSC as likely exploited, estimating suspicious fund movements of approximately $300,000. The researcher said funds had moved from multiple contracts through intermediary wallets to Relay and were believed to have been bridged and subsequently routed to Tornado Cash. It said it was continuing to track additional addresses.
The language matters: the account described the activity as a likely exploit and the value as approximate. The alert did not establish a finalized dollar loss independently confirmed by Predict Fun. It also did not provide a reproducible technical breakdown showing which contract function was used, whether permissions had been abused, or whether a pricing, redemption or accounting mechanism failed.
Without those details, it is not possible to determine whether the suspicious movement involved users’ collateral, trading liquidity, a treasury-controlled address, fees collected by the application or a different pool of funds. Nor does the reported figure prove that exactly $300,000 was successfully converted into an asset under an attacker’s ultimate control.
No attacker identity or recovery amount has been verified from the available public evidence. It would also be premature to assume that trading or withdrawals have stopped or that every customer balance is exposed. Those conclusions would require direct operational confirmation from the platform and an identifiable set of affected contracts.
How Could Funds Travel From BNB Chain Through Relay to Tornado Cash?
The reported sequence has three distinct stages: assets leave addresses linked to several contracts; a receiving wallet passes them toward Relay for cross-chain execution; and assets on the destination network are reportedly transferred into Tornado Cash. The chain of movements, if corroborated with transaction hashes, could help establish where suspicious value went after the initial outflow.
Each stage answers a different question. The originating contract transaction is where investigators would look for evidence of unauthorized withdrawals or a software flaw. The intermediary address could help group related transfers, although common timing and shared destinations alone do not identify the wallet’s controller. Relay is a cross-chain routing and settlement service; its appearance in a transaction path does not, by itself, imply Relay was hacked, colluded with an attacker or knowingly handled stolen funds.
This is especially important because Relay had a separate, previously disclosed issue in September involving the exposure of pending order data to sophisticated traders. DaveFinances covered that earlier Relay API leak and its customer-impact estimates. There is no evidence in the new Predict Fun alert connecting the two events or indicating the September weakness caused the October 27 transfers.
Tornado Cash adds another analytical obstacle. Its privacy contracts accept deposits and allow later withdrawals without publishing a simple one-to-one link between the two addresses. A reported deposit can make the subsequent trail harder to reconstruct, but is not proof of a successful sale on an exchange or that the attacker has escaped identification or recovery efforts.
A separate DaveFinances investigation of Cysic-linked transfers into Tornado Cash demonstrated the difference between funds already removed in an exploit and their later movements through privacy infrastructure. In the Predict Fun case, even the initial exploit has not yet been conclusively explained. Repeated movements of the same proceeds should not be added together as new losses.
What Is at Risk for Predict Fun Traders?
Predict Fun is a BNB Chain-based venue for trading contracts linked to event outcomes, including cryptocurrency prices, sports and other future developments. Traders put collateral behind positions that settle according to market rules. The project also offers yield-bearing positions using decentralized-finance integrations. Those functions can create several interconnected classes of smart-contract and operational exposure.
Its public documentation describes smart-contract wallets and a noncustodial design in which the platform says it does not possess users’ private keys. Noncustodial control can reduce certain centralized custody risks, but does not automatically protect tokens deposited into an unsafe contract. Once collateral has been moved into a contract, its security depends on that contract’s rules, administrative permissions, price and resolution inputs, and interactions with any integrated lending or settlement system.
It is not yet known which, if any, of those mechanisms may be implicated here. An exploiter might target a permissioned withdrawal function, a redemption calculation, a misconfigured administrator, an external dependency or something unrelated to the contract code. Listing those possibilities does not mean any has been observed in the reported transactions.
The distinction between a possible vulnerability and observed exploitation is familiar in prediction markets. An earlier DaveFinances report examined a theoretical reentrancy and accounting problem affecting Predinex Stellar, where a code-level concern did not establish that customer funds had been stolen. Predict Fun presents the reverse evidentiary challenge for now: suspicious outward transfers have been alleged, but the mechanism is unidentified and the net loss has not been confirmed.
Public dashboard metrics such as total value locked and aggregate trading volume would not solve that gap. Total value locked is a snapshot of assets deposited into specified contracts, not the amount lost in an attack; trading volume counts transaction activity, not a guaranteed reserve for reimbursement. A $300,000 suspected flow cannot simply be subtracted from reported protocol-wide balances to calculate remaining customer protection.
What Evidence Would Confirm the Loss and the Route?
The next decisive step is publication of the originating transaction hashes and contract addresses. Those would permit independent analysts to determine whether the outflows were authorized by contract logic, how much value was actually removed, and whether the receiving wallets can reliably be associated with the same operation. Destination-chain transactions and specific Tornado Cash deposit records would then be needed to confirm the reported bridging and mixing sequence.
Predict Fun’s own response is just as important. An incident notice could identify whether a contract was paused, which markets and user balances were affected, whether the reported transfers involved treasury funds or customer collateral, and whether an independent security team had reproduced a flaw. It could also clarify whether reimbursement is warranted or whether any suspicious transfers had a legitimate explanation.
For users, a cautious approach is to consult the platform’s official channels before initiating new deposits or interacting with unexpected security prompts. They should not trust unsolicited messages promising recovery or ask them to reveal wallet credentials. There is not enough verified evidence to recommend an indiscriminate withdrawal or claim that users must revoke a particular token approval; those responses should be based on identified exposure and legitimate instructions.
From an investor’s perspective, the news highlights a structural vulnerability in rapidly growing on-chain financial products: a transfer may be visible long before the community knows whether it reflects theft, normal settlement, administrative activity or an accounting fault. Bridging into other chains can accelerate the difficulty of tracing the final beneficiary. But the arrival of funds at a privacy contract is a follow-on event, not a diagnosis of the original security failure.
For now, the defensible conclusion is narrow. Onchain Lens has identified around $300,000 in flows it believes may be linked to an exploit of Predict Fun-related contracts, with a reported cross-chain path through Relay and onward to Tornado Cash. The platform’s confirmed loss, the root cause, the affected customers and any recovery remain unestablished. A transaction-level investigation and an official response are needed before the suspected incident can be described as a verified $300,000 hack.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574