At least 19 wallets linked to prediction market platform Predict.fun have reportedly been drained of approximately 105 ETH, worth $260,000, with investigators tracing the suspected stolen funds through Ethereum to cryptocurrency mixer Tornado Cash.
Summary
- At least 19 wallets linked to Predict.fun have reportedly been drained of approximately 105 ETH worth $260,000, according to findings shared by on-chain investigator Naeven.
- The suspected incident first surfaced after a user reported losing roughly $5,000 and raised concerns that other Predict.fun users were experiencing similar unauthorized withdrawals.
- Investigators traced the suspected stolen funds through multiple intermediary wallets and Ethereum before they were reportedly forwarded to cryptocurrency mixer Tornado Cash.
- Naeven warned that more wallets may have been affected and urged users with funds remaining on Predict.fun to move their assets out of the platform.
- The exact cause of the reported wallet drain remains unclear, with investigators yet to establish whether compromised permissions, malicious signatures, or a vulnerable contract were involved.
On-chain investigator Naeven reported the suspected attack on October 27, after another crypto user known as dethective disclosed losing roughly $5,000 and raised concerns that other people using Predict.fun were experiencing similar unauthorized withdrawals.
According to Naeven, the identified victims collectively lost 105 ETH, although the investigator believes the actual number of affected wallets could be higher.
The investigation found that funds from multiple addresses were being transferred across networks before reaching Tornado Cash, a cryptocurrency mixing service commonly used to obscure the transaction history of digital assets.
Naeven shared a transaction flow diagram showing several victim wallets connected to intermediary addresses, with funds eventually converging on wallets identified as drainers.
The investigator urged users who still had funds on Predict.fun to move their assets out of the platform.
Predict.fun wallet drain first reported by affected user
The suspected incident first gained attention after X user dethective disclosed that approximately $5,000 had been taken from their wallet within the preceding hour.
In the post, the user suggested something was wrong with Predict.fun and claimed that other affected wallets appeared to have connections to the prediction market platform.
“I think there’s something wrong going on with Predictfun and I am not the only victim,” the user wrote.
The post included a wallet address, 0x8b001D7378DBc19C1c62E39c0fC9FFAD84182fBa, which the user identified as receiving the stolen funds.
An accompanying transaction screenshot showed an outgoing transfer of approximately 4,845 USDT from an address labeled Kernel, alongside earlier transactions involving a Predict.fun contract.
The screenshot displayed transfers of 17.253 USDT and 105.63 USDT associated with a contract labeled Predict Fun: CTFAutoRedemptionH…, although the precise connection between those earlier transactions and the reported theft was not established.
Shortly afterward, Naeven published a separate analysis suggesting the problem extended beyond the initial complaint.
The investigator’s transaction map identified several wallets allegedly affected by the same activity, with transfers passing through different addresses before reaching Ethereum.
While the findings suggest multiple users were targeted, the precise method used to access their funds remains unknown.
Investigators trace 105 ETH toward Tornado Cash
Naeven’s findings suggest the suspected attacker used multiple intermediary wallets to collect assets from affected addresses before moving the proceeds to Ethereum.
According to the investigator, the funds were subsequently forwarded to Tornado Cash, where transaction mixing can make it more difficult to follow their movement.
The transaction diagram showed several separate groups of victim wallets sending assets into collection addresses, which then routed the funds through other wallets.
Some of the transfers were labeled as movements from BNB Chain to Ethereum, while others involved direct Ethereum transactions.
Predict.fun operates on BNB Smart Chain, using USDT as collateral for prediction markets where participants trade positions based on the outcomes of future events.
The platform uses conditional token contracts to manage positions and settlements, including redemption transactions when markets resolve.
There was no confirmed figure for the total number of affected users beyond the 19 addresses identified by Naeven.
Tornado Cash has received funds from other crypto thefts
The reported movement of funds to Tornado Cash follows several recent incidents in which attackers transferred stolen cryptocurrency through the mixing protocol.
Earlier this month, crypto.news reported that wallets associated with the Drift Protocol exploit had transferred approximately $109 million in Ether to Tornado Cash over two days.
The transactions involved an estimated 44,510 ETH, while wallets linked to the attacker reportedly retained another 56,569 ETH, valued at roughly $138 million.
In a separate October incident, blockchain security firm Salus traced approximately $12.4 million in cryptocurrency from the Triple-A treasury breach into Tornado Cash.
The investigator identified 56 deposits involving 4,970 ETH, including 49 transfers of 100 ETH and seven transfers of 10 ETH.
Another case involving malicious wallet approvals was reported on October 5, when security firm Salus linked unauthorized USDG withdrawals to permit signatures that granted attackers unlimited spending permissions.
According to Salus, the perpetrators used the permissions to move funds immediately after obtaining authorization, completing the approval and withdrawal within a single transaction.
The firm found that the stolen assets were divided between two attacker-controlled addresses in an 80% and 20% split, resembling the distribution structure used by some drainer operations.
In the Predict.fun case, investigators have not established whether malicious token approvals played a role in the reported losses or whether the affected wallets interacted with a common compromised contract.
