Fraudsters tried to steal at about $10 million through Polymarket U.S. beginning in February, depositing funds with stolen debit cards, placing bets, and trying to withdraw the proceeds to accounts they controlled, according to a Wall Street Journal investigation published Saturday. Polymarket CEO Shayne Coplan responded to the attack by telling employees to prioritize growth and address any regulatory fines later, the report said.

Payment processor Checkout.com alerted Polymarket to the attack. At one point it rejected more than 80% of the Polymarket U.S. deposits it handled as fraudulent, against an industry-standard rate near 1%, according to the Journal. Roughly seven users accounted for the bulk of the activity, the report said, noting that one user attempted around 4,000 separate deposits. The Journal did not establish how much of the $10 million succeeded, though one person cited in the report said most attempted deposits failed.

This story is an excerpt from the Unchained Daily newsletter.

As the fraudulent deposits piled up alongside a backlog of legitimate withdrawal requests, Polymarket leadership allegedly dropped a requirement that funds deposited from one payment source be withdrawn to that same source. The rule is not mandated for prediction markets, but it is standard at financial institutions and is the specific safeguard that stops stolen-card proceeds from being moved to a clean account. Employees warned the change invited money laundering, but executives said existing rules were sufficient, according to the Journal.

Polymarket U.S. chief compliance officer Andrew Clifford resigned in April after submitting a detailed report on the fraud to executives. The company then fired U.S. CEO Justin Hertzberg, and its heads of U.S. regulation and anti-money-laundering also left. An internal investigation by law firm Sullivan & Cromwell concluded Polymarket had complied with regulations, the Journal reported, citing sources familiar with the matter. Fraud rates reportedly returned to industry norms by May after the platform capped how many debit cards a user could link. In late July, a separate registration flaw let attackers with a victim’s Social Security number take over roughly 500 accounts, along with linked bank accounts and cards, without knowing any password, the Journal reported, citing a person familiar with the matter.

The CFTC is investigating Polymarket in relation to the fraud attack, and staff have been told to preserve records, according to the Journal. Polymarket relaunched in the U.S. in beta in late 2025. Polymarket is now raising roughly $1 billion at a $21 billion valuation, with Donald Trump Jr.’s 1789 Capital adding about $300 million on top of $200 million already invested, and Coplan has reportedly discussed a 2027 IPO. The company has hired former Amazon finance chief Warren Jenson as its first CFO. A Polymarket spokesperson told the Journal its “market integrity framework includes processes to detect, review and respond to suspicious activity.”

Related Listen: CME vs. Kalshi. Is Washington Picking a Winner in Prediction Markets?