Polymarket US, the federally regulated prediction market operated by QCX LLC, became the target of a stolen debit-card scheme in February that involved at least $10 million in attempted illicit withdrawals and wagers, according to a Sept. 19 report by The Wall Street Journal.
The $10 million figure refers to the attempted movement of funds rather than a confirmed loss suffered by customers or the company, the Journal reported. Criminals allegedly connected stolen cards to thousands of Polymarket US accounts, funded those accounts, attempted to move the money through trading, and then sought to withdraw it to cards or accounts they controlled.
Polymarket US operates through QCX, which the Commodity Futures Trading Commission lists as a designated contract market and which received its designation in July 2025, according to the agency's register. Prediction markets have drawn increasing regulatory attention since the 2024 election, when Polymarket projected that Donald Trump had a 59.7% chance of winning the presidency and carried more than $584 million in bets on that outcome [1]. The State Department later issued a memorandum reminding employees worldwide that using undisclosed official information for financial gain is a "very serious offense," a directive that referenced prediction platforms including Polymarket [2].
Report: Checkout.com Rejected More Than 80% of Deposits as Fraudulent at Peak
At the peak of the February attack, payment processor Checkout.com rejected more than 80% of the deposits it handled for Polymarket as fraudulent, compared with an industry level of roughly 1%.
The 80% figure has not been publicly confirmed by Checkout.com in a statement reviewed for the report. The processor does provide merchants with fraud-scoring, transaction-filtering and authentication tools, and its current service terms state that merchants remain responsible for deciding whether transactions are accepted or canceled.
Current and former employees told the Journal that compliance workers escalated concerns about the surge in fraudulent deposits to Polymarket CEO Shayne Coplan. According to people cited by the newspaper, Coplan responded: "Just keep growing and pay a fine if regulators ever find out." Polymarket has not publicly confirmed that the remark was made, and the company told the Journal that it maintains procedures to identify and respond to suspicious activity and remains committed to cooperating with regulators and law enforcement.
Debit-Card Limits, Riskified Deployment Said to Lower Fraud Rates by May
The Journal reported that elevated fraud continued for several months after February, though rejection rates did not return to the peak recorded during the first wave. By May, fraud rates had reportedly moved back toward normal industry levels after Polymarket limited how many debit cards users could connect to their accounts and brought in Riskified as an outside antifraud provider.
An earlier report from The Information had separately described prediction-market operators, including Polymarket, strengthening card-fraud controls after criminals used stolen payment credentials and fake identities to create accounts. Visa reportedly pushed payment processors to tighten screening as disputed transactions increased.
Riskified provides automated fraud-decision systems used to identify suspicious card activity before merchants approve transactions. Public material from the company describes its service as combining machine-learning risk scoring with merchant transaction controls, but Riskified has not publicly disclosed Polymarket-specific fraud numbers. The Journal further reported that Polymarket initially required some withdrawals to return to the same payment source that had funded an account, and that the platform later loosened that restriction, citing employees who raised concerns about financial-crime risks.
Polymarket US Operates Under CFTC-Regulated QCX; Prior Penalty Cited
QCX LLC, doing business as Polymarket US, is listed as a designated contract market and received its designation in July 2025, according to the CFTC. Polymarket US is legally separate from the company's international blockchain-based prediction market, which uses separate infrastructure and access rules, according to the report.
The regulatory status differs from Polymarket's position in 2022, when the CFTC ordered the company to pay a $1.4 million civil penalty for offering event-based binary options without operating through a registered market. The settlement required Polymarket to wind down noncompliant markets and cease the violations cited in the order, according to the agency.
The Journal reported that the CFTC is now investigating issues connected with Polymarket and that employees were instructed to preserve documents involving the February fraud incident and other matters; no new public CFTC enforcement release specifically addressing the February stolen-card episode was located as of Sept. 20. The reported investigation should be treated as an ongoing inquiry described by the Journal, not a finding that Polymarket violated federal law.
Separate congressional scrutiny was already underway. On May 22, the House Committee on Oversight and Government Reform requested records from Polymarket concerning identity verification, suspicious activity, geographic restrictions and referrals to U.S. authorities. That inquiry centered on insider trading and sensitive information, not the stolen-card scheme reported by the Journal.
Company Cites Strengthened Controls and Hires; Separate 2026 Incidents Reported
Since the February incident, Polymarket has expanded its internal investigation and management functions. Shana Bautista, a former FBI investigator, joined as global head of investigations and intelligence, and the company named Warren Jenson, a former Amazon, Electronic Arts, Delta Air Lines and Nielsen finance executive, as its first chief financial officer on Sept. 10, the company said. Polymarket did not announce an IPO timetable when it appointed him, although the Journal reported that the company is preparing itself for a potential public listing.
Polymarket's own market-integrity page says the company has referred more than 90 accounts to law enforcement and supplied authorities with details involving more than 315 wallets. The figures are company-reported and do not relate exclusively to payment-card fraud.
The Journal reported separate account-security episodes in 2026. In June, Polymarket confirmed that a compromised third-party vendor injected malicious code into its frontend for some users; the company said it removed the affected dependency, contained the incident and would reimburse affected customers. Blockchain investigators later estimated losses at roughly $3.1 million across 11 wallets, according to the report. The Journal also reported a July incident involving nearly 500 users in which attackers used stolen personal information to access existing accounts and linked payment methods through an engineering weakness; Polymarket reportedly agreed to cover affected losses.
The company's current position is that its fraud controls have been strengthened and that it works with law enforcement on suspicious activity. The Journal's report says February's payment-fraud rate had returned to industry norms by May after debit-card restrictions and the Riskified deployment. Independent outlets have emphasized that platform transparency and verified user identity remain unresolved questions for prediction markets as a category.
Conclusion
The company's response has included tighter limits on linked debit cards, an outside antifraud vendor, senior hires in investigations and finance, and stated cooperation with law enforcement and regulators.
Whether those measures fully resolve the underlying risks remains an open question as of late September 2026. The dispute also illustrates a recurring pattern documented across financial markets – suspicious trading activity raising insider-trading concerns, as seen in the roughly $7 billion in oil futures trades flagged in March and April [3] and the $125 million oil trade reported ahead of a U.S.-Iran announcement [4]. Those episodes, like the Polymarket matter, remain under investigation, with no public conclusions as of this report.
References
- NaturalNews.com. "Betting website Polymarket Donald Trump odds on favorite to win it all in November". NaturalNews.com. October 25, 2024.
- NaturalNews.com. "US State Department warns diplomats against using insider information for Iran related wagers". NaturalNews.com. May 09, 2026.
- NaturalNews.com. "7 billion in suspiciously timed oil trades sparks insider trading fears". NaturalNews.com. May 11, 2026.
- Garrison Vance. "Oil Trader Nets Estimated 125 Million on Suspiciously Timed Bet Ahead of US Iran Deal Report". NaturalNews.com. May 10, 2026.
Explainer Infographic
Please contact us for more information.