Polymarket Faced $10M Fraud Attack as Execs Chased Growth

TL;DR

• Fraudsters allegedly attempted to steal at least $10 million from Polymarket’s U.S. platform using stolen debit cards.

• Payment processor Checkout.com reportedly rejected more than 80% of Polymarket deposits at one point, compared with an industry fraud rate of roughly 1%.

• The company later removed a safeguard requiring users to withdraw money to the same payment source used for deposits.

Fraudsters Target Polymarket With Stolen Debit Cards

Polymarket faced an attempted theft of at least $10 million through stolen debit cards earlier this year as executives pushed the prediction market platform to prioritize growth, according to a Wall Street Journal investigation.

Fraudsters reportedly began targeting Polymarket’s U.S.-facing platform in February 2026, shortly after the regulated service started admitting customers from its waitlist.

The attackers allegedly used stolen debit cards to fund Polymarket accounts, place bets, and then attempt to withdraw the proceeds to cards or accounts under their control. The strategy was designed to move funds away from the original compromised payment sources.

Checkout.com, Polymarket’s payment processor, alerted the company to the activity. At one point, the processor reportedly rejected more than 80% of deposits to Polymarket’s U.S. platform as fraudulent. The typical industry rate is approximately 1%.

Visa later instructed Checkout.com to reduce the volume of fraudulent Polymarket transactions, prompting the payment processor to demand stronger safeguards from the company.

Polymarket’s compliance staff were reportedly surprised by CEO Shayne Coplan’s response to the fraud wave. According to sources cited by the Journal, Coplan told employees to concentrate on growth and deal with possible regulatory penalties later.

The investigation did not establish how much of the attempted $10 million theft was successful. One source said most fraudulent deposits were blocked.

Approximately seven users were responsible for most of the activity, according to the report. One account allegedly attempted around 4,000 separate deposits.

Polymarket did not disclose how much money was ultimately lost. A company spokesperson told the Journal that the platform remained committed to operating fair and transparent markets while cooperating with regulators and law enforcement.

The spokesperson added that Polymarket’s market-integrity framework includes procedures for identifying, reviewing, and responding to suspicious transactions.

Polymarket Reportedly Removed Withdrawal Safeguard

The surge in fraudulent deposits contributed to a growing backlog of withdrawal requests from legitimate customers, overwhelming Polymarket’s compliance team.

Company executives subsequently removed a safeguard requiring customers to withdraw funds to the same payment source used to make the original deposit.

Although the measure is not legally required for prediction markets, it is commonly used by financial institutions to combat money laundering and card fraud. The restriction prevents someone using a stolen card from withdrawing funds to a separate “clean” account.

Some employees reportedly warned that removing the rule could increase money-laundering risks and encourage additional attacks. Executives maintained that the platform’s remaining controls were sufficient.

Polymarket later limited the number of debit cards that customers could connect to their accounts. By May, the platform’s fraud rate had reportedly returned to industry norms.

The incident coincided with several senior departures as Polymarket positioned itself for a potential public listing.

Polymarket US Chief Compliance Officer Andrew Clifford resigned in April after submitting a detailed report to executives about the company’s fraud problems, according to the Journal.

The company later dismissed U.S. CEO Justin Hertzberg, while its heads of U.S. regulation and anti-money-laundering compliance also left.

An investigation by law firm Sullivan & Cromwell concluded that Polymarket had complied with applicable regulations, according to people familiar with its findings.

Since May, the company has reportedly hired experienced risk-management personnel and strengthened its compliance procedures and product-testing processes.

Registration Flaw Exposes Nearly 500 Accounts

Polymarket suffered a separate security incident in late July that reportedly affected almost 500 users.

Attackers allegedly exploited a weakness in the platform’s account-registration process. By attempting to create a new account using an existing customer’s personal information, such as a stolen Social Security number, an attacker could gain access to that customer’s account, connected bank accounts, and debit cards.

The vulnerability reportedly did not require attackers to know the victim’s existing username or password.

A source characterized the overall amount stolen as small, although affected users said they lost thousands of dollars in some cases. Customers also complained that messages to Polymarket’s support team went unanswered for weeks.

Polymarket said it would reimburse affected users.

CFTC Scrutiny Looms Over Polymarket’s Fundraising

The reported security and compliance problems come as Polymarket faces potential scrutiny from the Commodity Futures Trading Commission. Employees have reportedly been instructed to preserve documents connected to the fraud incidents and other company matters.

The CFTC has declined to confirm or deny whether it is investigating the platform. Polymarket previously faced criticism over allegations that it paid online creators to stage bets and winnings on replica websites. 

Those claims prompted two U.S. senators to call for a CFTC investigation, after which Polymarket reportedly reorganized its marketing team.

Meanwhile, the company is seeking approximately $1 billion in new financing at a valuation of around $21 billion.

Donald Trump Jr.’s investment firm, 1789 Capital, is reportedly contributing about $300 million after previously investing roughly $200 million. Trump Jr. sits on Polymarket’s advisory board and also serves as a strategic adviser to rival prediction market Kalshi.

Coplan has reportedly discussed preparations for a potential 2027 initial public offering. Polymarket has also hired its first chief financial officer, former Amazon finance chief Warren Jenson.

A Polymarket spokesperson said the company was proud of its leadership appointments and infrastructure improvements, adding that it remained focused on responsible growth.