Fraudsters attempted to steal at least $10 million from the Polymarket platform using stolen debit cards. The attack, which began in February, involved approximately seven accounts, with one account making around 4,000 deposit attempts. At the peak of the activity, payment processor Checkout.com flagged over 80% of Polymarket US deposits as fraudulent, significantly higher than the industry average of 1%.
To manage payment delays for legitimate users, Polymarket allowed withdrawals to sources other than the original deposit method. Despite warnings from some staff about increased risks of money laundering and fraud, management proceeded with the change. Later, the platform restricted the number of debit cards per account, and by May, fraudulent activity returned to industry-standard levels.
In a separate incident in July, unauthorized parties accessed nearly 500 customer accounts using stolen personal data. Polymarket has committed to compensating affected users. The company maintains that it cooperates with regulators and law enforcement, and an audit by the law firm Sullivan & Cromwell confirmed compliance with regulatory requirements.
Separately, a trader named Beni accused the platform Kalshi of inflating crypto trading volumes. The claims focused on perpetual futures, where high turnover was observed relative to open interest. Kalshi’s crypto lead, IcoBeast, denied the allegations, clarifying that the incentive program mentioned by the trader does not apply to prediction markets. As of September 21, no official CFTC rulings confirm these claims.
