Stolen Debit Cards, an 80 Percent Fraud Rejection Rate and a CEO Quote That Won’t Go Away: Inside the Polymarket Fraud Scandal

Stolen Debit Cards, an 80 Percent Fraud Rejection Rate and a CEO Quote That Won’t Go Away: Inside the Polymarket Fraud Scandal

A Wall Street Journal investigation published September 19 has put Polymarket’s United States operation under the sharpest regulatory spotlight since its return to the American market, alleging that fraudsters used stolen debit cards in February to attempt at least 10 million USD in illicit deposits, wagers and withdrawals on the platform.

According to the Journal, criminals connected stolen cards to thousands of Polymarket US accounts, funded them, traded through them, and then attempted to withdraw the proceeds to cards or accounts they controlled. At the peak of the February attack, payment processor Checkout.com rejected more than 80 percent of the deposits it handled for Polymarket US as fraudulent — a rate the newspaper contrasted with an industry norm of roughly 1 percent. Checkout.com has not publicly confirmed the figure.

The report’s most explosive element is cultural rather than technical. Current and former employees told the Journal that compliance staff escalated concerns about the fraud surge to Chief Executive Officer Shayne Coplan, who allegedly responded: “Just keep growing and pay a fine if regulators ever find out.” Polymarket has not publicly confirmed Coplan made the remark, and the company told the Journal it maintains procedures to identify and respond to suspicious activity and remains committed to cooperating with regulators and law enforcement.

Important caveats cut in both directions. The 10 million USD figure represents the amount fraudsters allegedly attempted to move, not a confirmed loss to customers or to Polymarket, and public reporting does not establish how much was successfully withdrawn. On the other hand, the Journal also reported that the Commodity Futures Trading Commission is now investigating issues connected to Polymarket, and that employees were instructed to preserve documents relating to the February fraud episode and other matters.

From February flood to May normalization

The February wave was not a one-week event. Elevated fraud reportedly continued for several months, though rejection rates never returned to their first-wave peak. By May, fraud rates had reportedly fallen back toward normal industry levels after Polymarket limited how many debit cards users could connect to their accounts and brought in Riskified, an outside antifraud vendor whose machine-learning systems score card transactions before merchants approve them. Riskified has not disclosed Polymarket-specific figures.

An earlier report by The Information had separately described prediction-market operators strengthening card-fraud controls after criminals combined stolen payment credentials with fake identities, with Visa pushing payment processors to tighten screening as disputed transactions climbed. The Journal also reported that Polymarket initially required some withdrawals to return to the original funding source before later loosening that restriction — a change employees flagged as a financial-crime risk.

A regulated exchange at the center of the storm

The legal backdrop complicates the story. Polymarket US is legally separate from the company’s international blockchain platform and operates through QCX LLC, which the CFTC’s register lists as a designated contract market — a designation received in July 2025, before the Polymarket US branding. The platform’s current rulebook, filed with the CFTC in a March 20 version certified in April, gives the exchange authority to restrict accounts and place customers into liquidation-only status to protect market integrity.

That regulated status stands in contrast to Polymarket’s earlier brush with the commission, which in 2022 ordered the company to pay a 1.4 million USD civil penalty for offering event-based binary options without a registered market. A new enforcement action targeting the February card-fraud episode has not been announced.

2026 has already been a bruising year for the platform’s security record beyond payment fraud. In June, Polymarket confirmed a compromised third-party vendor injected malicious code into its frontend; blockchain investigators later estimated losses at roughly 3.1 million USD across 11 wallets, with AMLBot reporting stolen assets bridged from Polygon to Ethereum. In July, the Journal reported, attackers used stolen personal information to access nearly 500 existing accounts through an engineering weakness, with Polymarket agreeing to cover affected losses.

Money keeps arriving anyway

The scandal has not slowed the money. Intercontinental Exchange, the New York Stock Exchange’s parent, disclosed a further 600 million USD cash investment in March after putting 1 billion USD into the company in 2025, and Polymarket has separately been seeking roughly 1 billion USD in new capital at a valuation near 21 billion USD, according to prior reporting. The company also recently hired Warren Jenson as chief financial officer while expanding compliance, investigations and risk-management staffing — moves the Journal linked to preparations for a potential public listing.

For a platform operating under federal derivatives oversight, the stakes of the Journal’s reporting are clear: a CFTC investigation into whether growth was prioritized over fraud controls could test the “pay a fine” calculus in ways no previous episode has. Bitcoin, meanwhile, traded at 80,434 USD as of 12:00 UTC on September 20, with Ethereum at 2,576.98 USD and Solana at 108.47 USD, according to CoinGecko data.