Polymarket was hit by a large fraud campaign in February in which criminals tried to steal at least $10 million from the platform, according to a Wall Street Journal investigation published Saturday. The report says the group used stolen bank debit cards and that CEO Shayne Coplan told employees to focus on scaling first and deal with regulatory fines later.
The Journal said the activity targeted Polymarket's U.S. platform only a few months after it opened to American users under a regulated structure. The alleged scheme was straightforward: fraudsters deposited funds with stolen debit cards, placed bets, and then tried to cash out winnings into accounts they controlled in order to launder the money.
Payment processor reportedly blocked most suspicious deposits
According to the report, Checkout.com, Polymarket's payment processor, warned the company about the attack and at one point rejected more than 80% of Polymarket deposits as fraudulent. The Journal compared that with an industry standard of roughly 1%.
The report also pointed to earlier coverage from The Information in June saying Visa had instructed Checkout.com to curb fraudulent payments tied to Polymarket. That, in turn, pushed the processor to demand tighter controls from the platform.
The Journal, citing people familiar with internal messages, said most of the attempted fraudulent deposits did not go through. About seven users were said to be responsible for the bulk of the attack, and one of them allegedly attempted around 4,000 separate deposits. The report did not specify how much of the attempted $10 million was ultimately stolen. Polymarket also did not respond to follow-up questions from The Block, according to the source material.
Anti-money-laundering safeguard was later removed
The fraud wave added to a backlog of withdrawal requests from legitimate users and put more strain on the compliance team. The report says Polymarket management later removed a rule designed to reduce money-laundering risk by requiring funds deposited from a given payment source to be returned to that same source.
While that rule was not described as a legal requirement specific to prediction markets, the Journal said similar controls are widely used at other financial institutions because they can stop fraudsters from depositing with stolen debit cards and withdrawing to different, clean accounts.
Some employees warned that removing the rule could increase money laundering and make future attacks easier, the report said. Senior management believed other existing controls were sufficient.
The episode unfolded during a period of executive turnover as Polymarket prepared for a possible IPO. Andrew Clifford, the company's U.S. chief compliance officer, resigned in April after submitting a detailed report to executives outlining fraud issues. Polymarket later fired U.S. CEO Justin Hertzberg, and its U.S. head of regulation and anti-money-laundering chief also left the company.
Second attack in July affected nearly 500 users
Polymarket was hit again in late July. This time, nearly 500 users were targeted.
The Journal said attackers exploited what it described as an obvious account registration flaw. By trying to register a new account with an existing customer's personal information, including stolen Social Security numbers, they could gain full access to that customer's account, along with linked bank accounts and debit cards, without knowing the original username or password.
One person familiar with the matter described the amount stolen as small but did not provide a figure. A Polymarket spokesperson told the Journal that the company would reimburse lost funds. At the same time, the Journal and Discord messages reviewed by the paper showed that some users lost thousands of dollars and did not receive responses after messaging customer support for weeks.
The report added that by May, after Polymarket introduced measures including limits on how many debit cards a user could link, its fraud rate had fallen back to normal industry levels.
CFTC probe adds pressure as fundraising continues
The U.S. Commodity Futures Trading Commission is investigating Polymarket. The Journal said employees have been instructed to preserve records related to the fraud incidents and other matters.
The article also referred to an earlier Journal investigation that said Polymarket paid creators to manipulate fake bets and fake wins on copycat sites, prompting bipartisan senators to call for a CFTC investigation.
An internal review by Sullivan & Cromwell concluded that Polymarket had complied with relevant regulations, according to the report. The company has also hired former Amazon CFO Warren Jenson as its first chief financial officer, added risk management staff since May, and improved compliance procedures.
Even so, the regulatory overhang remains unresolved. Polymarket is seeking about $1 billion in funding at a valuation of roughly $21 billion. Donald Trump Jr.'s investment firm, 1789 Capital, is expected to invest about $300 million, on top of a previous $200 million investment. The report also said Coplan met 1789 Capital co-founder Omeed Malik in June to discuss preparations for a potential 2027 IPO.
For now, the company's fundraising plans and IPO ambitions are moving ahead while it deals with fraud, account security failures, and regulatory scrutiny. The outcome of the CFTC investigation, and whether Polymarket can show that the control gaps have actually been fixed, remains central to what comes next.