Polymarket faced $10 million fraud attempt as its CEO pushed growth over compliance concerns: WSJ

Polymarket faced an attempted theft of at least $10 million through stolen debit cards earlier this year, while the firm's CEO, Shayne Coplan, urged employees to prioritize growth and downplayed compliance concerns, according to a Wall Street Journal investigation published Saturday.

Per the investigation, fraudsters began targeting Polymarket's U.S.-facing platform in February of 2026, months after the regulated platform began admitting users off its waitlist. Fraudsters reportedly used stolen debit cards to deposit funds on the platform, make bets, and then attempted to withdraw the winnings to "clean" cards or accounts they controlled. 

Polymarket payment processor Checkout.com, which alerted the prediction market firm to the attack, at one point rejected more than 80% of the Polymarket US deposits it handled as fraudulent, compared to the industry-standard level of roughly 1%, per the report. The Information reported in June that Visa had instructed Checkout.com to curb fraudulent Polymarket payments, prompting the processor to demand tighter controls from the platform.

Polymarket's compliance team, according to the recollections of sources consulted by the Journal, was surprised by Coplan's response: focus on growth now, and worry about any regulatory fines later. 

The report did not establish how much of the attempted $10 million theft succeeded, but one person cited by the Journal stated that most attempted deposits failed. Around seven users were responsible for the bulk of the attack, according to that person, with one reportedly attempting around 4,000 separate deposits. Polymarket did not immediately respond to a request for further information from The Block, including a question about how much money was actually stolen in the attack. 

A Polymarket spokesperson told the Journal the company was committed to fair and transparent markets and cooperation with regulators and law enforcement.

"Our market integrity framework includes processes to detect, review and respond to suspicious activity," the spokesperson said.

Polymarket reportedly dropped withdrawal safeguards

The wave of attempted fraudulent deposits compounded a backlog of withdrawal requests from legitimate users, overwhelming the firm's compliance staff, the report found. 

Polymarket's leadership subsequently dropped a requirement meant to tamp down on money laundering, that funds deposited from one payment source must be withdrawn to the same source. The rule, while not a regulatory requirement for prediction markets, is commonplace at other financial institutions, and helps to guard against attacks from stolen debit cards, as funds cannot be withdrawn to a separate "clean" card while the rule is in place.

Though some employees warned that the rule change could lead to an increase in money laundering and other attacks, Polymarket's executives maintained that other rules in place were sufficient to discourage this activity, per the report.

The incident comes as Polymarket has seen some turnover in high-ranking positions as the company positions itself for a potential IPO. Polymarket US chief compliance officer Andrew Clifford resigned in April after submitting a detailed report to executives outlining fraud issues, people familiar with the document told the Journal. The company subsequently fired U.S. CEO Justin Hertzberg, while its heads of U.S. regulation and anti-money-laundering also departed.

An investigation by law firm Sullivan & Cromwell concluded that Polymarket complied with regulations, according to people cited by the Journal familiar with the report's findings.

By May, following measures that included limiting how many debit cards users could link to their accounts, fraud rates returned to industry norms, a person familiar with the matter told the Journal.

Separate attack exposed accounts of nearly 500 users

In late July, nearly 500 Polymarket users were targeted by attackers exploiting an apparent account-registration flaw. An attacker attempting to create an account with an existing customer's personal information, such as a stolen Social Security number, could gain full access to that customer's account and linked bank accounts and debit cards without knowing their pre-established username or password, the Journal reported, citing a person familiar with the incident.

That person characterized the amount stolen as small, without providing a figure. A Polymarket spokesperson told the Journal the company would cover lost funds. Sources interviewed by the Journal and Discord messages reviewed by the publication described some users losing thousands of dollars to the attack, with weeks of messages to Polymarket's support team going unanswered. 

Regulatory scrutiny comes amid fundraising push

The Commodity Futures Trading Commission is investigating Polymarket, per an earlier WSJ report citing a person familiar with the matter, and employees have been instructed to preserve records related to the fraud attack and other matters, the Journal reported.

A CFTC spokesperson told The Block at the time that the agency could neither confirm nor deny an investigation.

The earlier investigation from the WSJ found Polymarket paid creators to stage bets and wins on replica websites, as The Block reported, prompting calls from a bipartisan pair of senators for the CFTC to investigate the firm. Polymarket subsequently restructured its marketing team, according to Saturday's report.

The latest allegations come as Polymarket seeks roughly $1 billion in financing at a valuation of around $21 billion. Donald Trump Jr.'s investment firm, 1789 Capital, is contributing approximately $300 million, on top of roughly $200 million previously invested, the Journal reported. Trump Jr., President Donald Trump's son, is a member of Polymarket's advisory board and is also a strategic advisor to its rival, Kalshi. 

Coplan also met with 1789 Capital co-founder Omeed Malik in June to discuss preparing the company for a potential IPO in 2027, according to people familiar with the meeting cited by the newspaper.

Polymarket has since hired its first chief financial officer, former Amazon CFO Warren Jenson, who was in that role for about two and a half years starting in September 1999. Since May, the firm has also added experienced risk-management staff and improved compliance procedures and product testing, according to the report.

"We are proud of our key leadership hires and continuous infrastructure upgrades and we have quickly scaled and remain focused on growing responsibly at the frontier of finance, tech, and culture," a Polymarket spokeswoman told the Journal.