SEO description: Polymarket faced a reported $10 million stolen-card scheme as lawmakers, regulators and investors scrutinize its controls.
Tags: Polymarket, CFTC, Shayne Coplan, House Oversight Committee, Wall Street Journal, Intercontinental Exchange
market_platform: Polymarket
category: Regulation
Polymarket faced a February 2026 stolen-card fraud wave in which fraudsters attempted to move at least $10 million through its U.S. platform, the Wall Street Journal reported on September 19. The report lands as the prediction-market operator pursues a $1 billion funding round at a roughly $21 billion valuation and faces scrutiny from lawmakers, regulators and private plaintiffs.
According to the Journal, fraudsters linked stolen debit cards to thousands of Polymarket U.S. accounts, then tried to use wagers and withdrawals to extract funds. At one point, payment processor Checkout.com rejected more than 80% of deposits it handled as fraudulent, compared with an industry rate of roughly 1%. Current and former employees told the Journal that compliance staff raised concerns with Chief Executive Officer Shayne Coplan, who said the company should keep growing and pay any regulatory fine if one came.
The fraud rate later fell from the February peak, according to the Journal. But the episode was followed by a July security incident in which an engineering flaw allowed attackers using stolen personal information to access existing accounts, affecting nearly 500 users. The Journal also reported internal concern and executive departures as the company tried to professionalize controls while continuing to expand.
What did the Journal report about Polymarket’s fraud controls?
The Journal’s account describes a control problem at the point where Polymarket’s U.S. ambitions intersected with ordinary payment fraud. Stolen-card attacks are familiar to consumer-finance companies, but the reported rejection rate, more than 80% of deposits handled by Checkout.com at one point, was far above the roughly 1% industry benchmark cited in the report.
The mechanics mattered because prediction-market accounts can be used to move value quickly. Fraudsters allegedly connected stolen debit cards, placed wagers and sought withdrawals. The Journal reported that Polymarket initially required withdrawals to go back to the same payment source, a common anti-fraud control, but later relaxed that approach. The company has said it strengthened risk-management and compliance staffing and uses blockchain analytics, machine learning and trade-surveillance tools to detect suspicious activity.
The February attack was not the only issue in the Journal’s September 19 report. The paper said the July account-access flaw affected nearly 500 users. That incident was different from stolen-card fraud: attackers used stolen personal information to access accounts that already existed. Together, the two episodes give regulators and investors a concrete set of questions about account verification, payment controls, withdrawals and incident response.
What is the CFTC looking at around Polymarket?
The Commodity Futures Trading Commission has not publicly confirmed the details of any current Polymarket investigation. The Wall Street Journal and CNBC reported in June that the CFTC was investigating the company, while Forbes reported that the agency declined to comment. Those reports came shortly after separate Journal reporting on Polymarket’s promotional practices.
The distinction matters. Public reporting points to federal scrutiny, but the CFTC has not issued a public order, complaint or settlement describing the scope of a current inquiry. That means the clearest public record remains a mix of agency actions already released, congressional letters and court filings, not a CFTC statement laying out current allegations.
Polymarket has been before the CFTC before. On January 3, 2022, the agency entered an order against Blockratize Inc., doing business as Polymarket.com, in CFTC Docket No. 22-09. The CFTC said Polymarket had offered off-exchange event-based binary options and failed to obtain designation as a designated contract market or registration as a swap execution facility. The order required a $1.4 million civil monetary penalty, a wind-down of noncompliant markets and a cease-and-desist from further violations of the Commodity Exchange Act and CFTC regulations.
Federal scrutiny did not end with that settlement. A later Justice Department and CFTC probe tied to whether Polymarket allowed U.S. users to access its offshore platform was dropped in July 2025 without charges, according to Forbes. The current wave of reporting therefore sits against a longer regulatory history, not a single prior enforcement matter.
How did Polymarket’s marketing practices become part of the Washington fight?
A separate Wall Street Journal report published in June said Polymarket paid online creators to make promotional videos showing staged trading activity on dummy sites resembling Polymarket. The Journal reviewed 1,105 videos from 10 creators and found that none of the roughly $1.9 million in apparent wagers shown in the videos were real, according to summaries of the report by The Block and TechCrunch.
The Block reported that 118 videos showed creators celebrating nearly $900,000 in fabricated winnings, while identical real trades would have lost more than $166,000. Polymarket told the Journal it was committed to accurate, fair and transparent markets and would review promotional content. The issue is legally significant because Polymarket’s main offshore platform was previously unavailable to U.S. users under the 2022 CFTC settlement, while the creator campaign was reported to have targeted U.S. audiences.
Senators John Curtis, Republican of Utah, and Adam Schiff, Democrat of California, sent a June 25 letter to CFTC Chairman Michael Selig asking whether the agency was investigating the conduct described in the Journal’s marketing report. The senators also asked what consumer-protection standards apply to prediction-market advertising, influencer marketing, age verification and responsible-gaming safeguards, and requested written answers by July 10, 2026.
The House Oversight Committee opened a separate inquiry on May 22, 2026. Chairman James Comer, Republican of Kentucky, sent letters to Coplan and Kalshi Chief Executive Officer Tarek Mansour requesting documents about identity verification, geographic restrictions and suspicious-trading monitoring. The committee’s Polymarket letter requested materials no later than June 5, 2026.
What litigation is Polymarket facing?
Private litigation has followed the advertising reports. The National Association of Consumer Advocates filed suit on June 26 in the Superior Court of the District of Columbia against Blockratize Inc., Adventure One QSS Inc., QC Tech LLC doing business as PM US Tech, QCX LLC, QC Clearing LLC, Coplan and Chief Marketing Officer Matthew Modabber. Vaca Daffan Law, which represents the plaintiff, said the complaint alleges a deceptive marketing campaign that encouraged Americans to risk real money while obscuring how likely people were to lose.
The complaint is at an early stage. Its allegations are not findings by a court. Still, the case adds another public forum where Polymarket’s promotional practices, corporate entities and U.S. customer controls may be tested through filings, motions and discovery.
How does this affect Polymarket’s funding and IPO ambitions?
The compliance scrutiny comes as Coplan is pitching investors on a $1 billion fundraise that would value Polymarket at approximately $21 billion, according to the Journal. The Journal also reported that Donald Trump Jr.’s 1789 Capital is investing roughly $300 million in the round. Polymarket has hired Warren Jenson, the former Amazon chief financial officer, as its first CFO, a move aimed at giving the company more public-company financial discipline.
Intercontinental Exchange, the parent of the New York Stock Exchange, has a reported 22% stake in Polymarket through a $1.6 billion investment. That makes the company more than a crypto-adjacent startup story. It is now tied to one of the central institutions in U.S. market infrastructure, which raises the stakes around compliance, surveillance and consumer-protection controls.
The near-term issue is whether Polymarket can close a $1 billion round at a $21 billion valuation while answering a more basic institutional question: whether its U.S. controls match the scale of the business it is pitching to investors. The September 19 Journal report gives lawmakers, regulators, plaintiffs and prospective backers a sharper factual record to test against Polymarket’s compliance staffing, payment controls and incident response.
