Polymarket US Targeted in $10M Stolen-Card Fraud Scheme
Key Points
- Polymarket US, the company’s federally regulated prediction market, was targeted by a stolen-card scheme involving at least $10 million in attempted transactions.
- Payment processor Checkout.com reportedly rejected more than 80% of Polymarket US deposits as fraudulent at the peak of the attack, versus an industry norm of roughly 1%.
- The Journal did not establish how much of the attempted $10 million was successfully stolen, and one person familiar with the incident said most attempted deposits failed.
- Polymarket subsequently restricted how many debit cards could be linked to accounts and added fraud controls that reportedly brought fraud rates back near normal levels by May.
Fraudsters Used Stolen Debit Cards to Target Polymarket US for Over $10M
The Wall Street Journal reported Sunday that fraudsters exploited Polymarket US in February by connecting stolen debit cards to accounts, placing trades and then attempting to withdraw proceeds to clean cards or accounts under their control. The attempted transactions totaled at least $10 million.
The attack landed during the early growth of Polymarket’s regulated U.S. business. Polymarket US operates through QCX LLC, which is listed by the Commodity Futures Trading Commission as a designated contract market and is separate from the company’s international platform.
The $10+ million figure represents the attempted fraud amount, not a confirmed loss. Public reporting has not established how much money ultimately made it through the system or was successfully withdrawn.
A Small Number of Accounts Drove Most of the Fraud Attempts
The scheme appears to have been concentrated rather than spread across thousands of independent fraudsters. The Journal reported that roughly seven users accounted for most of the activity, with one account attempting approximately 4,000 separate deposits.
Checkout.com, which processed card payments for Polymarket US, reportedly raised the alarm as fraudulent transactions surged. At one point, the processor was rejecting more than 80% of the Polymarket deposits it handled as fraudulent, compared with an industry benchmark of roughly 1%.
That is a remarkable failure rate for a consumer payment channel. Even if most of the transactions were successfully blocked, the volume indicates attackers had identified Polymarket US as a viable target and were willing to hammer the deposit system repeatedly.
The Journal also reported that Polymarket relaxed a safeguard requiring withdrawals to return through the same payment source used for the deposit as the company dealt with a backlog of legitimate withdrawal requests. Employees reportedly warned that loosening the restriction could increase fraud and money-laundering risks.
Polymarket Tightened Its Fraud Controls After the February Attack
According to the Journal, employees escalated concerns about the fraud problem to CEO Shayne Coplan and said he continued emphasizing growth despite warnings from compliance staff. Polymarket has disputed the broader characterization of its compliance practices, while an internal investigation by Sullivan & Cromwell reportedly concluded that the company complied with applicable regulations.
A Polymarket spokesperson told the Journal in an on-the-record statement that its market integrity framework includes processes to “detect, review and respond to suspicious activity.” The company also said it has strengthened its infrastructure, leadership and risk controls.
Polymarket began limiting the number of debit cards customers could connect to their accounts and brought in fraud-prevention company Riskified. By May, the fraud rate had reportedly returned to industry norms.
Those changes came alongside broader executive turnover and investment in compliance. Polymarket has also been expanding its leadership team while pursuing another major round of financing; Bloomberg reported in August that the company was raising about $1 billion at a $21 billion post-money valuation.
A Separate July Attack Added Another Security Problem
The February stolen-card scheme was not Polymarket’s only reported account-security problem this year. The Journal reported that nearly 500 users were targeted in July through a separate vulnerability involving stolen personal information.
According to the report, attackers could use compromised personal information, including Social Security numbers, to gain access to an existing customer account and its linked payment methods without knowing that customer’s established username or password. Polymarket reportedly said it would cover losses associated with the incident.
The two incidents involved different attack methods, but together they increase the pressure on Polymarket to demonstrate that its U.S. infrastructure can handle rapid customer growth without leaving basic account and payments controls behind.
Why This Matters For Bettors
Most bettors are going to read this story and have a much simpler concern than anything involving compliance departments or payment infrastructure: Can I put money on Polymarket US, make my trades and get my money back out without getting caught in somebody else’s fraud problem?
That is where a fraud rate like this starts hitting home. When a platform tightens security after an attack, legitimate customers can end up dealing with declined deposits, extra identity checks, card restrictions or withdrawals sent for additional review. Anyone who has had money sitting in a betting account while waiting on a security check knows how quickly that becomes the only thing they care about.
There is also the account-security side of the story. The February attack involved stolen cards, while the separate July incident reportedly involved attackers using compromised personal information to access existing accounts. Those are much more tangible problems than an abstract debate over Polymarket’s compliance program. You want to know that somebody cannot get into your account, use your payment method or create a mess that takes days to unwind.
Polymarket says it has strengthened those controls, and the reported fraud rate had returned closer to normal levels by May. That is encouraging, but bettors should still watch how the platform handles deposits, withdrawals and account reviews as its U.S. customer base grows. Security controls are only useful to customers if they stop bad actors without routinely trapping legitimate users in the same net.
For Polymarket specifically, trust is going to be earned at the cashier as much as in the markets themselves. Bettors may come for better prices, different markets or simply access to something their sportsbook does not offer. They are much less likely to stay if moving their own money becomes the part of the experience they have to worry about.
What Happens Next
The most important unanswered figure is how much of the attempted $10 million actually escaped Polymarket’s controls. The Journal reported that most attempts were unsuccessful, but neither the company nor the reporting has established a final loss total.
Attention will also remain on Polymarket’s response. The company has added fraud controls, expanded its risk operation and strengthened its executive ranks while continuing an aggressive U.S. expansion.
For bettors, the clearest signal will be whether those changes translate into a stable payments experience without excessive withdrawal friction. For regulators and payment partners, the standard will be tougher: whether Polymarket can demonstrate that its controls are capable of keeping pace with the size of the business it is trying to build.
Cole cut his teeth as a sportswriter in Texas, covering everything from Longhorns games to small-town Friday night lights. A lifelong bettor stuck with offshore books for over a decade thanks to Texas' slow path to legalization, he eventually found his way into the world of social sportsbooks - where he uncovered a fast-growing, community of bettors.
Today, he writes for the millions of Americans in states without legal books, helping them explore safe ways to bet without running afoul of the law.
As editor-in-chief, he aims to keep BettingScanner honest, human, and grounded in what bettors actually care about: fairness, fun, and finding your lane - even when the state won’t give you one.
