For a few frantic weeks in February 2026, the newest regulated prediction market in the United States looked less like a licensed exchange and more like an open till. Fraudsters linked stolen debit cards to thousands of freshly minted Polymarket US accounts, funded wagers, and then tried to pull the winnings onto clean cards or accounts they controlled, attempting to route at least $10 million through the platform, according to a Wall Street Journal investigation published on September 20, 2026.
When the compliance team took the alarm to Chief Executive Officer Shayne Coplan, they were told to keep growing and pay a fine if regulators ever caught on, people familiar with the events said.
The attempted haul reached at least $10 million, though the investigation by the Wall Street Journal did not establish how much of that figure actually left the platform. One person familiar with the matter said most attempted deposits failed.
Payments firm Checkout.com, which processes debit-card deposits for Polymarket US, flagged the attack first and at one point classified more than 80% of the deposits it was handling for the platform as fraudulent, against an industry benchmark of roughly 1%. About seven users drove most of the activity, and one of them alone attempted approximately 4,000 deposits.
Checkout.com continues to work with Polymarket and declined to comment on the incident or the relationship, as per WSJ.
Coplan’s Response and the Withdrawal Rule Change
The compliance team was “floored” by Coplan’s reply, according to people familiar with the exchange. Current and former employees described the reaction as consistent with a broader “growth at all costs” posture inside the firm.
The timing was material. Polymarket US had opened to early users in December 2025 after the parent company paid roughly $112 million for a licensed exchange and converted it into the American venue, a move that followed the Commodity Futures Trading Commission (CFTC) issuing an Amended Order of Designation that cleared the platform for regulated United States trading.
Traders deposited more than $500 million on the new product, a person familiar with the matter said. By January 2026, the American application still handled less than $300 million in betting activity, compared with more than $7.6 billion on the international platform.
Coplan wanted friction stripped off the American product even while it was still in beta. Discord channels filled with complaints about slow withdrawals, and staff told users that compliance checks could hold funds for days or weeks. Engineering glitches on the American application added further delays.
To speed payouts, leadership later scrapped a “same-source” withdrawal safeguard, a control used across much of the financial industry that requires funds deposited from one payment method to be withdrawn back to that same instrument. The rule is designed to block the classic stolen-card pattern of deposit, trade, then cash out to a clean instrument. Federal rules do not require prediction markets to keep the safeguard.
DraftKings and FanDuel use it, while Kalshi does not, though it inspects mismatched withdrawals and freezes suspicious payments, a person familiar with Kalshi’s protocols said. Some Polymarket employees warned that removing the rule could open a money-laundering path, but executives argued that other protocols were sufficient.
Former CFTC, Department of Justice and Internal Revenue Service (IRS) officials told the Journal that the scale of the attempt and the internal response were atypical for regulated commodities and gambling venues. Joe Konizeski, a former CFTC enforcement lawyer, said that in the regulated space this kind of failure does not occur, and that firms handling customer money are expected to verify sources and maintain proper controls.
Staff Exits, Internal Review and New Controls
Fraud rates remained elevated for months after February, though they did not return to the 80% peak. In April 2026, Andrew Clifford, the Chief Compliance Officer (CCO) of Polymarket US, resigned after sending executives a lengthy report on the fraud issues, people familiar with the report said. Clifford and the company declined to comment on his departure.
Soon after, Polymarket fired Justin Hertzberg, the CEO of its United States division, and the heads of American regulation and Anti-Money Laundering (AML) also left the firm. Hertzberg did not respond to requests for comment. Law firm Sullivan & Cromwell later concluded that the company had complied with regulations, according to people familiar with the findings.
By May 2026, fraud rates were back near industry norms. Polymarket had limited the number of debit cards a user could attach to an account and had hired antifraud vendor Riskified. The company has since added risk staff, including a former Federal Bureau of Investigation (FBI) agent, tightened compliance protocols and improved product testing.
A separate July incident exposed nearly 500 user accounts. An engineering flaw allowed attackers using stolen personal information to reach existing accounts and their linked payment methods. Polymarket reimbursed some affected users, while others reversed charges through their banks. Complaints also mounted after a July outage, including missing balances and locked accounts.
Employees have been instructed to retain records tied to the fraud attack and other matters. The CFTC is investigating the company. The New York City Council is separately examining advertising by Polymarket and other prediction markets. Almost two dozen traders have sued the firm over alleged deceptive practices, and more than a dozen state cases argue that Polymarket, Kalshi and other venues are unlicensed gambling platforms.
The Crypto Times has previously reported that Kentucky sued Polymarket and Kalshi as unlicensed sportsbooks, and that South Korea blocked the site after its regulator ruled the service constituted illegal gambling.
What Polymarket Said
A Polymarket spokesman said the firm is committed to accurate, fair and transparent markets and to working with regulators and law enforcement. “Our market integrity framework includes processes to detect, review and respond to suspicious activity,” the spokesman said.
A spokeswoman added that Polymarket is growing rapidly, is proud of its recent leadership hires and infrastructure upgrades, and remains focused on growing responsibly at the frontier of finance, technology and culture.
Capital Raise, Valuation and IPO Track
The compliance story sits on top of a fast financing cycle. Coplan is raising about $1 billion at a valuation of roughly $21 billion. Donald Trump Jr’s 1789 Capital is contributing about $300 million in the current round, on top of roughly $200 million already invested.
In late June, Coplan met 1789 co-founder Omeed Malik in the Hamptons to discuss professionalising operations ahead of a possible IPO within the next year, and Malik advised bringing in more seasoned executives.
Polymarket named Warren Jenson its first Chief Financial Officer (CFO) on September 10, 2026, according to a company statement. Jenson previously served as CFO of Amazon, Electronic Arts, Delta Air Lines and NBC, and as president and CFO of Nielsen. He also sits on the boards of Dropbox and Ripple. Coplan confirmed the appointment on X.
After the earlier marketing investigation in June, Polymarket restructured its marketing team and hired Bird founder Travis VanderZanden as chief of growth. Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange, invested $600 million in Polymarket in March 2026, according to later capital-markets reporting. That transaction, together with the current round, is the backdrop for the $21 billion figure now attached to the company.
Context and Background
The Crypto Times previously covered the June marketing probe, in which more than 1,100 creator videos were reviewed and none of the roughly $1.9 million in displayed bets were found to be real, with about $900,000 in fabricated wins publicised while the underlying positions would have lost more than $166,000 on the live book.
Days later, a third-party vendor compromise injected a malicious script into the Polymarket frontend and drained about $3 million in PUSD, which the platform said it would refund.
The company filed for a margin trading license through affiliate Coming Home GBA LLC as the CFTC inquiry widened, and United States senators later pressed the agency over the platform’s marketing practices.
Product expansion has continued in parallel. CLOB v2 and the pUSD token went live in April with $1 million in rewards, and perpetual futures with up to 20x leverage launched for non-United States users this month. Sports distribution now includes a reported $15 million a year football deal with LeBron James, on which James’s camp originally sought $20 million a year plus $50 million in equity, though the final terms have not been confirmed and James does not currently hold equity in the company, a person familiar with the matter said.
How to Read the $10 Million Figure
The $10 million represents attempted flow, not a confirmed loss for customers or the company. The Checkout.com rejection rate implies a large share of the deposits never settled, and public reporting has not established how much of the total actually left the platform. That distinction matters when comparing the incident with the June frontend theft, which security firm PeckShield put at close to $3 million in completed drains that Polymarket said it would repay.
The structural point is different. Polymarket US accepts retail debit-card deposits on a CFTC-designated contract market, which is closer to a brokerage or a licensed sportsbook cash-in rail than to a pure on-chain wallet flow. Former prosecutors have noted that weak controls around the source of funds can implicate money-transmission and bank-fraud statutes, pointing to earlier settlements paid by BitMEX and Binance.
Prediction markets currently operate under a lighter AML overlay than those venues, which is why the same-source withdrawal rule and processor monitoring carried significant weight inside the company.
Coplan is 28. Colleagues have described an intense operating style, extended working hours, and pressure on engineers to ship untested features. A recording from July 2025 captured him dismissing internal debate over dispute resolution. Those details do not by themselves establish a legal violation, but they help explain why compliance staff described the February reply as consistent with the way the firm had been run.
The company is now presenting a different picture to investors, with Jenson in the CFO seat, a former FBI agent in the risk function, Riskified on the card rail, Sullivan & Cromwell on the file, and a roughly $21 billion capital raise aimed at a 2027 listing. Those upgrades arrived after the February attack, the CCO memo, and the American leadership departures, not before.
Also Read: Brian Armstrong Says WSJ Preparing Story Blaming Him for CLARITY Act Failure
