Fraudsters attempted to steal at least $10 million through Polymarket's U.S. platform in February 2026 using stolen debit cards, and CEO Shayne Coplan reportedly told staff to focus on growth and deal with regulatory fines later. A separate July breach exposed close to 500 accounts, and the incidents surface as Polymarket seeks roughly $1 billion in financing at a valuation of around $21 billion.
Fraudsters targeted Polymarket's U.S.-facing platform starting in February 2026, using stolen debit cards to deposit funds, place bets, then withdraw winnings to "clean" cards or accounts they controlled, according to a Wall Street Journal investigation published Saturday. Polymarket's compliance team was reportedly surprised when Coplan urged them to prioritize growth first and worry about fines later.
Payment processor Checkout.com, which flagged the attack, rejected more than 80% of Polymarket US deposits it handled as fraudulent at one point, compared with an industry-standard rate of roughly 1%. Around seven users drove the bulk of the attack, with one reportedly attempting close to 4,000 separate deposits, though the report did not establish how much of the attempted theft succeeded.
Polymarket dropped a withdrawal safeguard
As the fraudulent deposits piled up alongside a backlog of legitimate withdrawal requests, Polymarket's leadership dropped a rule requiring that funds withdrawn match their original deposit source. The rule is not a regulatory requirement for prediction markets but is common at other financial institutions and helps block money laundering via stolen cards. Some employees warned the change could invite more attacks, but executives maintained other safeguards were sufficient, per the report.
By May, after Polymarket limited how many debit cards users could link to their accounts, fraud rates returned to industry norms, a person familiar with the matter told the Journal. An internal investigation by law firm Sullivan & Cromwell concluded Polymarket had complied with regulations.
A second breach hit hundreds of accounts
In late July, nearly 500 Polymarket users were targeted through an apparent account-registration flaw that let attackers take over accounts using stolen personal information such as Social Security numbers, without needing the victim's username or password. A Polymarket spokesperson said the company would cover lost funds. According to The Block: "Our market integrity framework includes processes to detect, review and respond to suspicious activity," a company spokesperson told the Journal.
The episodes come amid executive turnover as Polymarket positions itself for a potential IPO: compliance officer Andrew Clifford resigned in April after flagging the fraud issues, and the firm subsequently fired U.S. CEO Justin Hertzberg, while its heads of U.S. regulation and anti-money-laundering also departed. Polymarket is now seeking roughly $1 billion in financing at a valuation of around $21 billion, with Donald Trump Jr.'s 1789 Capital contributing about $300 million on top of roughly $200 million invested previously.
Source: The Block
Trading involves risk.
Risk Disclaimer
