WSJ reports a $10M stolen-card fraud attempt at Polymarket and a CFTC investigation
- Place in VP50
- #30
- Sources
- 2
- Claims verified
- 6 of 6
What happened
The Wall Street Journal reported that Polymarket was hit by a stolen-card fraud attack in February, in which fraudsters linked stolen debit cards to thousands of accounts and attempted to steal at least $10 million. Investing.com, which summarized the Journal's report, said the payment processor Checkout.com rejected more than 80% of the deposits it handled as fraudulent, against an industry rate of about 1%. Fraud rates remained elevated for months, though they did not return to February's peak. By May they were back to industry norms, after Polymarket limited the number of debit cards users could connect and hired Riskified as an antifraud contractor.
A second attack in July affected nearly 500 users. An engineering flaw let attackers using stolen personal information reach existing accounts, and Polymarket said it would cover the lost funds. The report said the CFTC is investigating the company and that employees were told to preserve records related to the February attack and other matters. Current and former employees told the Journal that compliance staff raised concerns with CEO Shayne Coplan. Polymarket said it has strengthened its risk-management and compliance teams and protocols as it considers an IPO.
Key points
- A February attack used stolen debit cards linked to thousands of accounts, with at least $10M in attempted theft.1
- Checkout.com rejected more than 80% of the deposits it handled as fraudulent, against about 1% for the industry.1
- A July attack affected nearly 500 users; Polymarket said it would cover their losses.1
- The CFTC is investigating Polymarket, and employees were told to preserve records.1
- Polymarket said it has strengthened its risk-management and compliance teams as it considers an IPO.1
Why it matters
A federal regulator's investigation is a regulatory exposure that sits behind the company's valuation. The report does not state the scope or outcome of the CFTC inquiry.
Polymarket said it would cover the funds lost in the July attack, so part of the cost of the incidents falls on the company itself.
The report places the compliance changes alongside the company's consideration of an IPO, so fraud controls and an open investigation are part of the record a listing would be judged against.
In context
| Round | Date | Post-money valuation | Raised | Led by |
|---|---|---|---|---|
| Funding round | Oct 2025 | $1.2B | $150M | Founders Fund |
| Private placement | Oct 2025 | $350M | $55M | Blockchain Capital |
| Series D | Oct 7, 2025 | $9.0B | $1.0B | Intercontinental Exchange |
| Series E | Mar 27, 2026 | $15B | $1.0B | Unknown |
| Funding round | Aug 31, 2026 | $21B | $1.0B | 1789 Capital |
Updated
Fact-check
- A February fraud attack attempted to steal at least $10 million using stolen debit cards linked to thousands of accounts.Confirmed by [1] Investing.com, which summarizes the WSJ report: fraudsters linked stolen debit cards to thousands of accounts in February and tried to steal at least $10 million. The WSJ page [2] could not be opened.Verified
- Checkout.com rejected more than 80% of deposits it handled as fraudulent, versus an industry rate of about 1%.Confirmed by [1] Investing.com, relaying the WSJ report. The WSJ page [2] could not be opened.Verified
- Fraud rates remained elevated for months and were back to industry norms by May, after Polymarket limited connected debit cards and hired Riskified.Confirmed by [1] Investing.com: rates stayed elevated for months without returning to February's peak, and were back to industry norms by May after those two steps.Verified
- A July attack affected nearly 500 users and Polymarket said it would cover lost funds.Confirmed by [1] Investing.com: an engineering flaw let attackers with stolen personal information into existing accounts, affecting nearly 500 users; Polymarket said it would cover losses.Verified
- The CFTC is investigating Polymarket, and employees were told to preserve records related to the February attack and other matters.Confirmed by [1] Investing.com. This is a reported investigation; no CFTC statement was read, and the WSJ page [2] could not be opened.Verified
- Compliance staff raised concerns with CEO Shayne Coplan, and Polymarket has strengthened its risk-management and compliance teams as it considers an IPO.Confirmed by [1] Investing.com, citing current and former employees who spoke to the Journal and the company's statement.Verified
Sources
- [1]Investing.com (citing WSJ) (opens in a new tab)Polymarket fraud concerns mount as company prepares for potential IPO - WSJThe CFTC is investigating the company
- [2]WSJ (opens in a new tab)Polymarket's Rush to Grow Left a Door Wide Open For Fraud
