Polymarket faced $10M debit-card fraud attempt as CEO prioritized growth

Polymarket's U.S. platform faced an attempted $10 million fraud in February, with attackers funding accounts using stolen debit cards and trying to withdraw winnings to clean cards or accounts they controlled, The Wall Street Journal reported.

Around seven users drove most of the attack. One attempted roughly 4,000 separate deposits. Most failed.

Checkout.com flagged the scheme; Visa had pushed for tighter controls

Polymarket's payment processor Checkout.com alerted the company to the attack. At one point the processor rejected more than 80% of Polymarket US deposits it handled as fraudulent, compared with an industry-standard level of roughly 1%.

Visa had earlier instructed Checkout.com to curb fraudulent Polymarket payments, The Information reported in June, prompting the processor to demand tighter controls.

Coplan told staff to prioritize growth; compliance team objected

Polymarket's compliance team was surprised by CEO Shayne Coplan's response, the Journal reported: focus on growth now, deal with any regulatory fines later.

Polymarket subsequently dropped a rule requiring funds deposited from one payment source to be withdrawn back to that same source, a control meant to limit money laundering. Internal warnings that the change could raise laundering risk did not change the decision.

US chief compliance officer Andrew Clifford resigned in April after submitting a detailed report to executives outlining fraud issues. The company later fired US CEO Justin Hertzberg. Its heads of US regulation and anti-money-laundering also departed.

Two more incidents hit users in June and July

In June, Polymarket confirmed hackers stole funds from some users after a compromise involving a third-party vendor. Malicious code was injected into the company's website for certain users, according to the company.

In late July, nearly 500 users were targeted by attackers exploiting an account-registration flaw that let them access existing accounts with stolen personal information, including Social Security numbers, without knowing the username or password. Some users lost thousands of dollars, and weeks of support messages went unanswered, the Journal reported. Polymarket said it would cover lost funds from the July attack.

The CFTC is investigating Polymarket, and employees have been instructed to preserve records related to the fraud attack and other matters, the Journal reported.

Fraud rates normalized by May; Sullivan & Cromwell cleared Polymarket

By May, after measures including limits on how many debit cards users could link to their accounts, fraud rates had returned to industry norms, a person familiar with the matter told the Journal.

A separate investigation by law firm Sullivan & Cromwell concluded that Polymarket had complied with regulations, the Journal reported, citing people familiar with the findings.

The wider backdrop: a $1B raise and an earlier marketing probe

Polymarket is seeking roughly $1 billion in financing at a valuation near $21 billion. Donald Trump Jr.'s investment firm 1789 Capital is contributing approximately $300 million, on top of roughly $200 million previously invested. Trump Jr. sits on Polymarket's advisory board and is a strategic advisor to rival Kalshi.

Coplan met with 1789 Capital co-founder Omeed Malik in June to discuss preparing for a potential 2027 IPO, the Journal reported. Polymarket has since hired former Amazon CFO Warren Jenson as its first CFO, and former Uber executive Travis VanderZanden as chief growth officer.

An earlier WSJ investigation found Polymarket paid creators to stage bets and wins on replica websites, prompting a bipartisan pair of senators to call for a CFTC investigation. Polymarket subsequently restructured its marketing team.

What Polymarket says

A Polymarket spokeswoman told the Journal the company is "proud of our key leadership hires and continuous infrastructure upgrades and we have quickly scaled and remain focused on growing responsibly at the frontier of finance, tech, and culture."

The company's market integrity framework "includes processes to detect, review and respond to suspicious activity," a spokesperson said, adding that Polymarket cooperates with regulators and law enforcement.