Polymarket hit by attempted $10m stolen-card fraud
Prediction market giant Polymarket reportedly faced an attempted $10 million fraud attack earlier this year after criminals flooded its US platform with stolen debit cards.
A new Wall Street Journal investigation says fraudsters linked stolen cards to thousands of Polymarket accounts in February before attempting to move money through trades and withdraw the proceeds.
Payment processor Checkout.com reportedly rejected more than 80% of Polymarket deposits it handled as suspected fraud at the peak of the attack.
The Journal compared that with an industry fraud rate of approximately 1%.
The $10 million figure represents the amount criminals allegedly attempted to move rather than a confirmed loss suffered by Polymarket or its customers.
The investigation also raises significant questions about Polymarket’s compliance culture as the prediction-market operator rapidly expanded in the United States.
Current and former employees told the Journal that compliance staff escalated concerns about the fraud to Polymarket CEO Shayne Coplan.
According to the newspaper, Coplan responded: “Just keep growing and pay a fine if regulators ever find out.”
Polymarket has not confirmed that Coplan made the remark.
The company told the Journal it maintains procedures to detect and respond to suspicious activity and remains committed to working with regulators and law enforcement.
The reported fraud attack is particularly significant because Polymarket has rapidly emerged as one of the world’s biggest prediction markets while simultaneously facing scrutiny over whether some of its event contracts amount to gambling.
Polymarket’s US operation currently operates through QCX, a Commodity Futures Trading Commission-designated contract market.
The CFTC previously fined Polymarket $1.4 million in 2022 for offering event-based binary options without operating through a registered market.
The company subsequently returned to the regulated US market after acquiring QCEX, which included the CFTC-regulated exchange and clearinghouse later renamed under the Polymarket brand.
According to the Journal, fraud levels returned closer to industry norms by May after the company tightened debit-card controls and introduced additional fraud-detection technology.
The February incident was not Polymarket’s only security problem this year.
A separate compromised third-party service affected the platform in June, while the Journal reports another incident involving almost 500 users occurred in July.
The revelations come at an awkward time for Polymarket as prediction markets face an increasingly aggressive challenge from US state gambling regulators.
Missouri last week ordered Polymarket, Kalshi and four other prediction-market companies to stop offering sports event contracts without a state sports betting licence.
