WSJ: Polymarket US faced $10M stolen-debit-card fraud attempt as Checkout.com flagged 80% deposits
By Crypto Wire
September 20, 2026
A Wall Street Journal investigation published September 20, 2026 says fraudsters linked stolen debit cards to thousands of Polymarket US accounts in February 2026, funded wagers, and tried to cash out to clean instruments—attempting to route at least $10 million through the CFTC-designated prediction market. Payments firm Checkout.com, which processes Polymarket US debit-card deposits, flagged the surge first and at one point classified more than 80% of deposits it handled for the platform as fraudulent, versus an industry benchmark near 1%. About seven users drove most of the activity; one alone attempted roughly 4,000 deposits. The Journal did not establish how much of the $10 million actually left the platform; people familiar with the matter said most attempted deposits failed.
Plain English Policy desks should separate attempted flow from confirmed losses. The $10 million figure is attempted routing, not a verified customer or company write-down. That distinction matters beside Polymarket’s separate June frontend drain—PeckShield put completed losses near $3 million in PUSD, which the platform said it would repay. Attribute the February card-rail episode and the Checkout.com rejection rate to the Journal’s September 20 reporting via Crypto Times and PYMNTS wraps; do not invent a settled loss total the sources do not state.
When compliance staff brought the alarm to CEO Shayne Coplan, people familiar with the events told the Journal he replied to keep growing and pay a fine if regulators ever discovered the truth. Staff described that answer as consistent with a “growth at all costs” posture while Polymarket US was still in beta after the parent paid roughly $112 million for a licensed exchange and converted it under a CFTC Amended Order of Designation. Traders deposited more than $500 million on the American product, a person familiar with the matter said, even as January 2026 U.S. betting activity remained under $300 million versus more than $7.6 billion internationally.
Leadership later removed a “same-source” withdrawal safeguard—the industry control that sends deposits back to the same payment instrument—to speed payouts after Discord complaints about multi-day holds. Federal rules do not force prediction markets to keep that control. DraftKings and FanDuel use it; Kalshi does not, though it inspects mismatched withdrawals, a person familiar with Kalshi’s protocols told the Journal. Some Polymarket employees warned that dropping the rule could open a money-laundering path; executives argued other protocols were enough. Former CFTC enforcement lawyer Joe Konizeski said failures of this scale are atypical for regulated commodities and gambling venues that verify funding sources.
Fallout stretched into spring. Fraud rates stayed elevated for months after February without returning to the 80% peak. In April 2026, Polymarket US Chief Compliance Officer Andrew Clifford resigned after sending executives a lengthy fraud report, people familiar with the memo said. Soon after, Polymarket fired U.S. division CEO Justin Hertzberg, and the heads of American regulation and AML also left. Law firm Sullivan & Cromwell later concluded the company had complied with regulations, according to people familiar with those findings. By May 2026, fraud rates were near industry norms after Polymarket limited debit cards per account and hired antifraud vendor Riskified, later adding risk staff including a former FBI agent.
The Journal says employees have been told to retain records tied to the fraud attack and other matters, and that the CFTC is investigating. New York City Council is examining prediction-market advertising; nearly two dozen traders have sued over alleged deceptive practices; more than a dozen state cases argue Polymarket, Kalshi, and peers are unlicensed gambling platforms. A Polymarket spokesman said the firm is committed to fair markets and works with regulators, citing processes to detect and respond to suspicious activity. Separately, Coplan is raising about $1 billion at a valuation near $21 billion, with Donald Trump Jr’s 1789 Capital contributing about $300 million on top of roughly $200 million already invested, and Warren Jenson named CFO on September 10, 2026.
Desks tracking prediction-market policy should treat the September 20 WSJ package as a controls-and-oversight story on a CFTC-designated debit-card rail—not a repeat of South Korea’s Polymarket prosecutor referrals or the Jacob Horne DeFi hire already on 8bitcrypto. Confirm the attempted $10 million figure, Checkout.com’s 80% fraud classification, the same-source rule removal, Clifford’s resignation, CFTC record-retention instructions, and Polymarket’s public integrity statement against the Journal and secondary wraps before treating any dollar as a finalized loss. Attribute Coplan’s alleged reply and staff reactions to anonymous sources as the Journal presented them.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
