TheBlock
Polymarket fended off an attempted theft of at least $10 million through stolen debit cards earlier this year while CEO Shayne Coplan urged staff to prioritize growth over compliance concerns, a Wall Street Journal investigation published Saturday found. Fraudsters began targeting the platform in February 2026, months after Polymarket US started admitting users off its waitlist, depositing stolen funds, betting, then attempting to withdraw winnings to clean accounts. Payment processor Checkout.com, which flagged the attack, at one point rejected more than 80% of Polymarket US deposits as fraudulent, compared with an industry norm of roughly 1%. A separate flaw exposed the accounts of nearly 500 users in late July.
Why it matters
The report describes a growth-first culture operating a regulated financial product. Polymarket's compliance team was reportedly surprised when Coplan told staff to focus on growth and worry about regulatory fines later. Leadership then dropped a standard funds-in, funds-out withdrawal safeguard against money laundering, despite employee warnings, compounding a backlog of legitimate withdrawals. Chief compliance officer Andrew Clifford resigned in April after flagging fraud issues, and US CEO Justin Hertzberg was subsequently fired. All of this lands while the Commodity Futures Trading Commission investigates the firm and a bipartisan pair of senators has called for a probe into staged bets on replica sites.
Market impact
Polymarket says fraud rates returned to industry norms by May after it limited how many debit cards users could link, and a Sullivan & Cromwell review found the company complied with regulations. But the allegations arrive as the company seeks roughly $1 billion at a $21 billion valuation, with Donald Trump Jr.'s 1789 Capital contributing about $300 million, and as it prepares for a potential 2027 IPO. The CFTC investigation and record-preservation instructions to staff are the overhang to watch for a company whose listing ambitions now depend on proving its controls caught up with its growth.
Frequently asked questions
-
How much did fraudsters attempt to steal from Polymarket?
At least $10 million, using stolen debit cards to deposit funds, place bets, and withdraw winnings to clean accounts. The report did not establish how much of the attempt succeeded, though most fraudulent deposits reportedly failed.
-
How bad was Polymarket's fraud rate compared to the industry?
Payment processor Checkout.com at one point rejected more than 80% of Polymarket US deposits as fraudulent, against an industry-standard level of roughly 1%. Fraud rates returned to industry norms by May after the company limited how many debit cards users could link.
-
What compliance safeguards did Polymarket drop during the fraud wave?
Leadership dropped a requirement that funds withdrawn from the platform go back to the same payment source they came from. The rule is common at financial institutions and blocks stolen-card fraud, since winnings cannot be moved to a separate clean card.
-
Is Polymarket under regulatory investigation?
The Commodity Futures Trading Commission is investigating Polymarket, per an earlier WSJ report, and employees have been instructed to preserve records related to the fraud attack. The CFTC said it could neither confirm nor deny an investigation.
-
How do the fraud issues affect Polymarket's IPO plans?
Polymarket is seeking roughly $1 billion in financing at a valuation of about $21 billion and has discussed a potential IPO in 2027. The compliance failures surfaced amid executive departures, including the US chief compliance officer's resignation, as the firm prepares for a listing.
CoinDesk
CryptoSlate
WuBlockchain