Polymarket dropped a key anti-money-laundering safeguard, then fraudsters tried to move $10m through it with stolen cards

Polymarket removed a key anti-money-laundering safeguard months before fraudsters tried to push at least $10 million through the platform using stolen debit cards, according to a Wall Street Journal investigation.

Internal compliance staff had warned CEO Shayne Coplan of rising fraud risk. He reportedly told them to prioritise growth and deal with fines later. Payment processor Checkout.com went on to reject over 80% of deposits as suspicious, against an industry norm of about 1%.

Polymarket’s growth strategy and prediction market regulation

According to a Wall Street Journal investigation cited in the original report, Polymarket’s internal compliance team had warned CEO Shayne Coplan about increasing fraud risks before the February attack.

Coplan reportedly instructed staff to prioritize growth and deal with potential fines later, according to the investigation.

A major change involved the removal of a “same-source” withdrawal requirement, a safeguard commonly used by financial platforms to ensure that money deposited from an account can only be withdrawn back to that same source.

Polymarket employees reportedly warned that eliminating the restriction could increase money-laundering risks. Despite those concerns, company leadership removed the requirement.

The decision became particularly significant when fraudsters allegedly exploited the resulting vulnerability. They used stolen debit cards to fund accounts, placed wagers on Polymarket and attempted to withdraw the resulting funds into accounts under their control.

The episode highlights a central issue for prediction market regulation: platforms that combine betting-like contracts, financial transactions and digital technology can face overlapping compliance obligations.

$10 million attack exposes compliance weaknesses

The February 2026 fraud operation reportedly involved thousands of accounts and at least $10 million in attempted wagers funded through stolen debit cards.

Checkout.com, Polymarket’s payment processor, identified the activity and rejected more than 80% of the deposits as suspicious. The reported figure was substantially higher than the approximately 1% rejection rate typically seen across the industry.

The scale of the rejected transactions raised questions about Polymarket’s onboarding and verification systems at the time.

The attack also demonstrated why the same-source withdrawal control had been considered important. Without that restriction, funds initially introduced through stolen payment credentials could potentially be transferred to accounts controlled by the perpetrators after being used to place wagers.

For companies operating in an increasingly regulated market, the incident illustrates how prediction market regulation extends beyond the contracts being traded. Payment processing, customer verification, fraud detection and withdrawal procedures can all become important parts of a platform’s compliance framework.

Polymarket tightens controls as prediction market regulation evolves

Polymarket reportedly strengthened its controls by May 2026, bringing fraud rates back toward normal levels.

The company introduced limits on the number of debit cards that could be connected to a single account and brought in Riskified, a fraud-prevention company, to strengthen its ability to identify suspicious activity.

Several senior compliance executives also left during the period, including US Chief Compliance Officer Andrew Clifford and US CEO Justin Hertzberg.

Polymarket subsequently commissioned Sullivan & Cromwell, a major US law firm, to conduct an internal review. According to the report, that review concluded that the company had remained compliant with applicable regulations.

The developments come as prediction market regulation remains an important consideration for platforms seeking to expand their operations in the United States.

Polymarket had previously relaunched its US operations under the oversight of the Commodity Futures Trading Commission following a 2022 settlement. That settlement resulted in a $1.4 million penalty over previously unregistered activities.

US oversight puts prediction market regulation in focus

Polymarket’s US operation differs from some of its international crypto-based services because it accepts fiat deposits through debit cards. That structure brings additional considerations around payment processing and financial compliance.

The reported fraud incident therefore places prediction market regulation alongside broader requirements governing financial transactions and anti-money-laundering controls.

Platforms handling fiat deposits through regulated payment processors can face obligations under the Bank Secrecy Act, while the CFTC has already taken enforcement action involving prediction-market operators.

The reported 80% rejection rate from Checkout.com could also attract attention because it suggests that the payment processor identified an unusually high level of suspicious activity during the attack.