In February, fraudsters linked stolen debit cards to thousands of Polymarket US accounts and attempted to run at least $10 million through bets. They deposited money stolen from other people’s cards, placed bets with it, and then withdrew the winnings to their own clean cards. The attack was spotted by the payment intermediary handling the platform’s card deposits, which at the time was blocking more than 80% of payments as fraudulent. Most of these deposits were made by around seven fraudsters using the same accounts, with one of them processing around 4,000 payments.
The internal compliance team warned management about the risks, but CEO Shayne Coplan did not consider it serious and said they would deal with it later. Soon afterward, the company removed a rule that allowed withdrawals only to the same source from which the deposit had been made. Employees warned that the change would lead to more money laundering, but management responded that the other restrictions would be sufficient.
But two months ago, the platform was hit not by its payment protection, but by its own registration system — a vulnerability at the end of July opened access to nearly 500 other people’s accounts, along with their linked cards and bank accounts. A stolen Social Security number was enough to gain access; no login or password was required. People lost thousands of dollars, while support failed to respond to requests for weeks. It is worth noting that all of this is happening against the backdrop of a new funding round, in which Polymarket is seeking around $1 billion at a $21 billion valuation. Meanwhile, the platform’s operations are already being examined by the US financial regulator CFTC, the House Oversight Committee, and more than a dozen states.
Every channel in the catalogue is checked by the editors against one method: it is how we work out the rating, place a channel at a risk level and decide whether it belongs in Market Scam.