In February 2026, the prediction market platform Polymarket suffered a $10 million fraud attack. The incident occurred after the company's leadership intentionally reduced anti-money-laundering safeguards to focus on user growth. Fraudsters used thousands of accounts linked to stolen debit cards to place bets and attempt to withdraw funds.
Checkout.com, the payment processor for the platform, identified and rejected over 80% of these deposits as suspicious. For comparison, the industry standard rejection rate is approximately 1%. Internal compliance teams had previously warned CEO Shayne Coplan about the rising risks, but he reportedly instructed staff to prioritize growth over regulatory compliance.
A key factor in the breach was the removal of the same-source withdrawal requirement, a standard industry rule ensuring funds are returned only to the original deposit account. By May 2026, the company reinstated stricter controls, including limits on linked debit cards and the integration of the fraud detection firm Riskified.
During this period, several senior executives left the company, including US Chief Compliance Officer Andrew Clifford and US CEO Justin Hertzberg. Polymarket commissioned an internal review by the law firm Sullivan & Cromwell, which concluded that the platform remained compliant with applicable regulations.
Polymarket operates under the oversight of the CFTC following a 2022 settlement involving a $1.4 million penalty for previous unregistered activities. The company is currently preparing for potential growth initiatives, including a possible IPO, while remaining subject to obligations under the Bank Secrecy Act.
