WSJ: Polymarket faced at least $10 million fraud attempt

A Wall Street Journal investigation reported that Polymarket faced an attempted theft of at least $10 million through stolen debit cards earlier this year. The investigation said CEO Shayne Coplan urged employees to prioritize growth and worry about regulatory fines later, while downplaying compliance concerns. Fraudsters began targeting Polymarket's U.S.-facing platform in February 2026, months after the regulated platform began admitting users from its waitlist. They used stolen debit cards to deposit funds, place bets, and try to withdraw winnings to clean cards or accounts they controlled. Polymarket payment processor Checkout.com alerted the company to the attack. At one point, Checkout.com rejected more than 80% of the Polymarket US deposits it handled as fraudulent, compared with an industry standard of roughly 1%. The Information reported in June that Visa had instructed Checkout.com to curb fraudulent Polymarket payments, after which the processor demanded tighter controls from Polymarket. Sources cited by the Journal said Polymarket's compliance team was surprised by Coplan's response. The report did not establish how much of the attempted $10 million theft succeeded. One person cited by the Journal said most attempted deposits failed. That person said around seven users were responsible for most of the attack, with one reportedly attempting around 4,000 separate deposits. Polymarket did not immediately respond to a request for further information, including a question about how much money was actually stolen. A Polymarket spokesperson told the Journal that the company was committed to fair and transparent markets and cooperation with regulators and law enforcement. The spokesperson said the company's market integrity framework included processes to detect, review, and respond to suspicious activity. The attempted deposits added to a backlog of withdrawal requests from legitimate users and overwhelmed Polymarket's compliance staff, according to the report. Polymarket's leadership subsequently dropped a requirement that funds deposited from one payment source be withdrawn to the same source. The report said the rule was not a regulatory requirement for prediction markets but was common at other financial institutions and helped prevent stolen debit cards from being used to withdraw funds to separate clean cards. Some employees warned that removing the rule could increase money laundering and other attacks. Polymarket executives maintained that other rules were sufficient to discourage such activity, according to the report. Polymarket US chief compliance officer Andrew Clifford resigned in April after submitting a detailed report to executives about fraud issues, people familiar with the document told the Journal. The company later fired U.S. CEO Justin Hertzberg, and its heads of U.S. regulation and anti-money-laundering also departed. People familiar with the findings said law firm Sullivan & Cromwell concluded that Polymarket complied with regulations. By May, measures including limits on the number of debit cards users could link to their accounts had brought fraud rates back to industry norms, a person familiar with the matter told the Journal. In a separate late-July attack, attackers reportedly exploited an apparent account-registration flaw that exposed nearly 500 users' accounts. An attacker using a customer's personal information, such as a stolen Social Security number, could reportedly gain full access to that customer's account and linked bank accounts and debit cards without knowing the person's username or password. A person familiar with the incident described the amount stolen as small but gave no figure. A Polymarket spokesperson told the Journal that the company would cover lost funds. Sources interviewed by the Journal and Discord messages reviewed by the publication described some users losing thousands of dollars, while weeks of messages to Polymarket's support team went unanswered. The Commodity Futures Trading Commission is investigating Polymarket, according to an earlier Wall Street Journal report citing a person familiar with the matter. Employees were instructed to preserve records related to the fraud attack and other matters, the Journal reported. A CFTC spokesperson told The Block at the time that the agency could neither confirm nor deny an investigation. An earlier Journal investigation found that Polymarket paid creators to stage bets and wins on replica websites. That report prompted calls from two senators from different parties for the CFTC to investigate, and Polymarket subsequently restructured its marketing team, according to Saturday's report. The latest allegations came as Polymarket sought roughly $1 billion in financing at a valuation of around $21 billion. Donald Trump Jr.'s investment firm, 1789 Capital, was contributing approximately $300 million on top of roughly $200 million previously invested, the Journal reported. Trump Jr. is a member of Polymarket's advisory board and a strategic adviser to rival Kalshi. Coplan met with 1789 Capital co-founder Omeed Malik in June to discuss preparing Polymarket for a potential IPO in 2027, according to people familiar with the meeting cited by the Journal. Polymarket has since hired its first chief financial officer, former Amazon CFO Warren Jenson. Jenson held that role for about two and a half years starting in September 1999. Since May, the company has also added risk-management staff and improved compliance procedures and product testing, according to the report. A Polymarket spokeswoman told the Journal that the company was proud of its leadership hires and infrastructure upgrades, had scaled quickly, and remained focused on growing responsibly.