Full Breakdown
Polymarket’s $10 Million Debit-Card Fraud Attack and Growth-First Response
By Drooid · · How we work
Core Incident: Fraud Attempt and Executive Reaction
In February 2026, Polymarket’s U.S. platform was hit by a coordinated debit-card fraud scheme that sought to move at least $10 million. Attackers used stolen cards to fund dozens of accounts, placed bets, and then tried to withdraw winnings to clean cards or accounts they controlled. Seven users were responsible for the bulk of the activity; one account alone generated roughly 4,000 deposit attempts.
The payment processor Checkout.com flagged the surge, rejecting over 80 % of Polymarket-U.S. deposits as fraudulent—far above the industry-average ? 1 %.
Background & Context
Polymarket operates a prediction-market platform transitioning from an offshore crypto-betting model to a regulated U.S. exchange. The company settled a 2022 CFTC enforcement action and, in 2025, acquired QCX and QC Clearing for $112 million to secure a CFTC-licensed pathway back into the U.S. market.
Polymarket is pursuing a $1 billion financing round that would value the firm near $21 billion. Donald Trump Jr.’s investment firm 1789 Capital is slated to contribute roughly $300 million, and the firm has discussed a potential 2027 IPO.
Data & Statistics
- Attempted loss: >= $10 million.
- Fraud detection rate: > 80 % of deposits flagged vs. ? 1 % industry norm.
- Accounts involved: ~7, with one account making ~4,000 deposit attempts.
- July 2026 follow-up attack: ? 500 users affected by a registration flaw that allowed access using stolen personal data.
- Funding round: $300 million from 1789 Capital; valuation target $21 billion.
Official Statements & Responses
- Polymarket hired former FBI agent Shauna Batista to lead its investigation, former Amazon CFO Warren Jenson as CFO, and former Uber executive Travis VanderZanden as chief growth officer.
- Law firm Sullivan & Cromwell conducted an internal audit and concluded that Polymarket complied with applicable regulations.
- The CFTC opened an investigation; employees have been instructed to preserve records related to the February fraud and subsequent incidents.
Criticism & Opposition
- Internal compliance staff warned that dropping the rule requiring withdrawals to use the same payment source as the deposit increased money-laundering risk; senior executives proceeded despite those warnings.
- A bipartisan pair of U.S. senators called for a CFTC probe after an earlier investigation revealed that Polymarket paid content creators to stage bets and wins on mirror sites.
On-the-Ground Reports
Affected users reported delayed withdrawals during the February surge. In July, attackers exploited a registration flaw to access existing accounts, compromising personal information such as Social Security numbers. Polymarket announced it would reimburse users who lost funds in the July incident.
What’s Next
Polymarket is positioning itself for a potential IPO. A Bloomberg report scheduled for August 31 will detail the $1 billion funding round led by 1789 Capital. The ongoing CFTC investigation may result in enforcement action, and the company has pledged further enhancements to its risk-management and compliance infrastructure as it pursues growth.
