Polymarket's Weakened AML Controls Lead to $10 Million Fraud Incident

Polymarket, the prediction market platform that gained popularity during the 2024 US election cycle, found itself embroiled in a significant fraud incident in February 2026, amounting to $10 million. This breach occurred after the company's leadership made the controversial decision to weaken anti-money-laundering (AML) safeguards in an aggressive push for growth. Reports indicate that CEO Shayne Coplan instructed staff to prioritize expansion over compliance, suggesting that any potential fines could be addressed later.

The fraud scheme involved criminals creating thousands of accounts linked to stolen debit cards, attempting to place at least $10 million in wagers before withdrawing the funds to accounts they controlled. Notably, Checkout.com, the payment processor for Polymarket, flagged and rejected over 80% of these deposits as suspicious. For context, the average rejection rate in the industry typically hovers around 1%, indicating a severe failure in the platform's onboarding and verification processes.

According to an investigation by the Wall Street Journal, Polymarket's internal compliance team had raised alarms regarding the escalating risk of fraud to Coplan, who reportedly dismissed these concerns in favor of growth. One of the most consequential changes made was the removal of a “same-source” withdrawal requirement, a standard industry safeguard designed to prevent funds from being withdrawn to accounts different from those that deposited them. Despite warnings from employees that eliminating this rule would heighten money laundering risks, leadership proceeded with the change.

The February 2026 fraud attack exploited the very vulnerabilities that the same-source rule was intended to mitigate. Fraudsters deposited funds via stolen debit cards, placed wagers on the platform, and subsequently attempted to withdraw their winnings to accounts they controlled, effectively laundering the stolen funds through the betting process.

Polymarket's Response to Fraud Challenges

By May 2026, Polymarket had implemented stricter controls that successfully reduced fraud rates to normal levels. The company imposed limits on the number of debit cards that could be associated with a single account and engaged Riskified, a fraud detection firm, to enhance its prevention capabilities. However, this period also saw the departure of several senior compliance executives, including US Chief Compliance Officer Andrew Clifford and US CEO Justin Hertzberg.

In response to the fraud incident, Polymarket commissioned an internal review conducted by the law firm Sullivan & Cromwell. This review concluded that the company had remained compliant with applicable regulations, despite the significant fraud attack.

The Unraveling

Polymarket operates as a regulated US prediction market platform that uniquely accepts fiat deposits via debit cards, distinguishing it from its international crypto-based counterparts. The platform had previously relaunched US access under the oversight of the Commodity Futures Trading Commission (CFTC) following a 2022 settlement that resulted in a $1.4 million penalty due to prior unregistered activities.

The staggering 80% rejection rate flagged by Checkout.com indicates a systemic failure in Polymarket's onboarding and verification processes. As the company prepares for potential growth initiatives, including a possible IPO, it faces increasing scrutiny from regulators, particularly as platforms handling fiat deposits through regulated payment processors are subject to anti-money-laundering obligations under the Bank Secrecy Act.