Polymarket Faces US Scrutiny Over $10 Million Stolen-Card Fraud Scheme

^{Shayne Coplan, CEO of Polymarket}

American prediction market platform Polymarket was targeted in a fraud attack involving stolen bank cards, according to a Wall Street Journal investigation.

The attack began in February 2026. Fraudsters created thousands of accounts on Polymarket US, funded them with stolen debit cards, placed bets, and attempted to withdraw the money to their own cards or accounts.

The scheme involved attempts to process at least $10 million.

Payment processor Checkout.com alerted the prediction platform to the issue. At the peak of the attack, the service was flagging more than 80% of deposits on Polymarket as fraudulent. The average rate in the industry is usually around 1%.

Most of the fraudulent activity was linked to seven users, with one of them alone attempting around 4,000 deposits.

At the same time, Polymarket was facing a backlog of withdrawal requests. To process them faster, company leadership removed a rule requiring users to withdraw funds using the same payment method they had used for deposits. Some employees warned that the change could make it easier to withdraw funds linked to stolen cards and increase money-laundering risks.

According to WSJ sources, Polymarket CEO Shayne Coplan urged employees to focus on growing the company and pay any fines later if regulators identified violations.

By May, the level of fraudulent activity had fallen back to roughly the industry average. To combat the issue, Polymarket limited the number of cards that could be linked to a single account and brought in fraud-prevention firm Riskified.

However, a new attack in late July affected nearly 500 users. A vulnerability in the registration system allowed fraudsters to enter an existing customer’s personal information and gain access to their account.

After the February attack, Polymarket US chief compliance officer Andrew Clifford prepared a report detailing the issues and later left the company. The company subsequently dismissed Justin Hertzberg, head of its US division.

The February attack is currently being reviewed by the US Commodity Futures Trading Commission (CFTC). A previous review by law firm Sullivan & Cromwell concluded that Polymarket complied with applicable regulatory requirements.

☘️ You might be interested to know — our promo code for 1xbet has been updated. Casino that gives you free spins.