Polymarket Faces CFTC Inquiry After WSJ Reports $10M Stolen-Card Fraud Attempt
United States
Marco Bello/Reuters
Source Analysis
What Happened
What Happened
Where Sources Agree
- arrows_inputFebruary Stolen-Card Fraud Incident: Coverage documents confirm that fraudsters attempted to steal at least $10 million from Polymarket using stolen debit cards in February, with payment processor Checkout.com rejecting over 80% of deposits as fraudulent, according to a Wall Street Journal investigation.
- arrows_inputLeadership Response and Culture: Most sources document that CEO Shayne Coplan prioritized growth over compliance during a fraud surge, reportedly instructing staff to "just keep growing and pay a fine" if regulators intervened, according to current and former employees.
- arrows_inputRegulatory Inquiry into Fraud: Coverage broadly details that the Commodity Futures Trading Commission is investigating a fraud incident at Polymarket while the House Oversight Committee has requested related records, with staff instructed to preserve relevant documents, according to official reports and internal instructions.
Where Sources Disagree
- arrows_outputCompliance Investigation Framing: While some sources emphasize that the CFTC is conducting an ongoing inquiry into the fraud incident, others highlight an internal investigation by the law firm Sullivan & Cromwell that concluded the company acted in compliance with applicable regulations.
- arrows_outputFraud Impact Assessment: Reports on the scale of financial impact vary slightly; while some emphasize that the $10 million figure represents attempted rather than confirmed losses, others highlight individual accounts where users reported specific losses in the thousands.
Timeline
September 21, 2026
Regulators and company response: Following the Journal's reporting, the CFTC began an inquiry and Polymarket employees were instructed to preserve records; Polymarket says it is cooperating with law enforcement, conducting audits of promotional content, and has made senior hires including a new CFO and head of investigations.
September 21, 2026
Alleged removal of AML control: The Journal reported Polymarket removed an anti‑money‑laundering control during the February attack that would have required deposits to be withdrawn to the same payment source; employees warned this invited laundering, CEO Shayne Coplan allegedly told staff to prioritize growth and address fines later, and senior U.S. leaders later resigned or were fired.
September 20, 2026
WSJ exposes February card scheme: The Wall Street Journal reported (Sept. 20) that in February fraudsters linked stolen debit cards to thousands of Polymarket US accounts and attempted to move at least $10 million through deposits, trades and withdrawals, while payment processor Checkout.com rejected more than 80% of deposits it handled at the attack's peak.
Summary by Ground AI
Sources
See All 35A varied selection of sources chosen by Ground to reflect the diversity of this story’s coverage.
Most Written About
The stories getting the most coverage from the last 24 hours
Source Analysis
Timeline
September 21, 2026
Regulators and company response: Following the Journal's reporting, the CFTC began an inquiry and Polymarket employees were instructed to preserve records; Polymarket says it is cooperating with law enforcement, conducting audits of promotional content, and has made senior hires including a new CFO and head of investigations.
September 21, 2026
Alleged removal of AML control: The Journal reported Polymarket removed an anti‑money‑laundering control during the February attack that would have required deposits to be withdrawn to the same payment source; employees warned this invited laundering, CEO Shayne Coplan allegedly told staff to prioritize growth and address fines later, and senior U.S. leaders later resigned or were fired.
September 20, 2026
WSJ exposes February card scheme: The Wall Street Journal reported (Sept. 20) that in February fraudsters linked stolen debit cards to thousands of Polymarket US accounts and attempted to move at least $10 million through deposits, trades and withdrawals, while payment processor Checkout.com rejected more than 80% of deposits it handled at the attack's peak.
