Stolen Cards Targeted Polymarket in $10 Million Fraud Attempt

Polymarket's U.S. betting platform fell victim to a sophisticated stolen-card fraud scheme seeking to defraud up to $10 million, reported The Wall Street Journal. The scheme emerged in February when a processing company identified a surge in fraudulent transactions. Per the Journal, hackers associated stolen debit cards with Polymarket US accounts and exploited them for placing bets, subsequently attempting to withdraw funds onto clean cards or controlled accounts.

At the peak, the processor flagged over 80% of deposits as fraudulent, a rate dramatically higher than the industry norm of roughly 1%. Polymarket's CEO Shayne Coplan received alarms from his compliance team about his response. Sources close to the situation described him as urging staff to proceed with growth despite potential regulatory repercussions.

The alleged statement from Coplan has not been independently verified. The incident shed light on the tension between expansion and fraud controls at the platform. Supplementary reporting indicated that fraud levels persisted for several months post the February spike. It also noted Polymarket later implemented stricter limits on the number of debit cards that could be associated with each account.

The fraud report is part of a larger concern over security and account safeguards at Polymarket. The company confirmed in June that some users lost funds following a third-party vendor compromise, where malicious code was injected into their website. In July, a separate incident involved nearly 500 users, in which an engineering vulnerability allegedly enabled attackers with stolen personal information to gain access to existing accounts.

Polymarket stated that it has enhanced its controls, added risk staff, and capped the number of debit cards that can be linked to a single account. Fraud rates returned to industry norms by May.