Overview
- In February 2026 criminals used thousands of stolen debit cards in an effort to move at least $10 million through Polymarket’s U.S. platform, and payment processor Checkout.com flagged and rejected more than 80% of deposits at the peak.
- Current and former employees told reporters that compliance teams raised alarms about the surge and that CEO Shayne Coplan allegedly urged the company to keep growing despite the risk.
- Polymarket briefly relaxed a same‑source withdrawal rule while handling the backlog, then in the following months imposed limits on linked debit cards, hired fraud vendor Riskified, and reimbursed some affected users.
- The Commodity Futures Trading Commission has been reported to be investigating the February episode and Polymarket commissioned a Sullivan & Cromwell review that sources say found the company compliant with applicable rules.
- The incident hit Polymarket’s dollar on‑ramp not its on‑chain settlement, and the episode raises reputational and financing risks as the company pursues roughly $1 billion in new funding and IPO preparations.