A Third-Party Page on Your Domain Became the Way In: Predict.fun's Docs Site Breach and the Udesk Script Injection

On October 27, BNB Chain prediction market Predict.fun reported unauthorized transfers from a small number of user wallets, totaling about 400,000 USDT. Its preliminary finding points to a compromise of its API documentation site, which is hosted by a third-party provider. The site has been taken offline, affected users will be fully reimbursed, and a post-mortem is pending. According to security researchers, the docs site sat on a subdomain of the main app, so injected script could act through users' logged-in sessions.

The same day, security researchers disclosed that scripts tied to the Udesk customer support widget had been injected with malicious code that collects sessions and form data, and swaps deposit addresses on the deposit pages of three exchanges.

What the two incidents share: the code that failed was not in the team's own repo, yet it ran on the team's own domain.

Where small teams are exposed

Five things you can do now

• Inventory who hosts each subdomain and which external JS each page loads
• Keep deposit, withdrawal and signing pages to essential scripts only; move support and analytics widgets off them
• Scope session cookies to the main app host, not to subdomains; put docs and help centers on a separate domain
• Enforce CSP and Subresource Integrity so a changed external script is blocked or alerted on
• Require a second confirmation for withdrawals and address changes, and give users an independent channel to verify deposit addresses

The Predict.fun timeline follows its official announcement; the intrusion method has not been published. The Udesk findings come from security researchers; how the code entered the script and how many sites were affected are not yet public. This article does not cover attack details.