Polymarket Hit by $10M Stolen-Card Fraud Attempt

Polymarket faced a major fraud and compliance test after attackers allegedly used stolen debit-card details to make at least $10 million in deposits on its US platform in February. The payment processor reportedly rejected more than 80% of deposits as potentially fraudulent at the peak of the operation, compared with an industry rate of about 1%. The amount successfully deposited or withdrawn remains unclear. Around seven accounts reportedly generated most of the suspicious activity, including one that attempted nearly 4,000 deposits. Attackers allegedly placed prediction-market bets and tried to withdraw funds to clean cards or accounts they controlled. The incident also raised concerns about Polymarket’s withdrawal safeguards after the platform removed a same-source withdrawal rule. Current and former employees told The Wall Street Journal that CEO Shayne Coplan encouraged rapid growth and deferred potential regulatory penalties. These claims have not been independently substantiated. Polymarket said it maintains market-integrity controls and cooperates with regulators and law enforcement. Polymarket later limited the number of debit cards that could be linked to an account, added Riskified fraud screening and expanded its compliance team. Fraud levels reportedly returned close to normal by May. A separate July security incident allegedly compromised nearly 500 user accounts using stolen personal information, including Social Security numbers. The incidents increase regulatory scrutiny of Polymarket’s KYC, AML, payment security and market-surveillance systems. The company’s US operator, QCX LLC, holds CFTC-designated contract market status and stated in a December 2025 CFTC rule submission that it would monitor abuse and fraud. For traders, the main risk is tighter onboarding, funding and withdrawal controls rather than a direct cryptocurrency price catalyst.