Polymarket's rapid push for growth draws scrutiny over compliance gaps and security lapses

By early this year, Polymarket's U.S. betting app was trying to scale quickly. That momentum collided with a major fraud attempt in February, when a partner institution handling debit-card processing warned the company that fraudsters had swarmed the platform. According to people familiar with the matter, criminals linked stolen debit cards to Polymarket US accounts, placed wagers, then tried to withdraw funds to their own "clean" bank accounts or cards, with an attempted haul of at least $10 million. The payment processor concluded that more than 80% of deposit transactions during the episode were fraudulent, a level far above an industry norm of around 1%. Insiders said staff escalated the risk to CEO Shayne Coplan right away. Members of the compliance team said Coplan's response stunned them: "Just keep expanding; if regulators find an issue, we'll just pay the fine." Current and former employees told The Wall Street Journal that the remark captures Coplan's leadership style: prioritizing growth, even as the company repeatedly ran into compliance shortfalls, legal disputes and software failures. People close to the company said the fraud rate did not return to 80% after February, but stayed elevated for months. Several executives left after the incident and Polymarket launched an internal review. Former officials from the Commodity Futures Trading Commission (CFTC), the Department of Justice and the Internal Revenue Service said they had rarely seen an attempted fraud campaign of this size—or a response like it—in either commodities markets or gambling. A key difference, they said, is that Polymarket takes funds directly from retail customers, unlike many traditional commodity exchanges, making it a more attractive target. Former CFTC enforcement attorney Joe Konizeski said: "In regulated spaces, this simply does not happen. Professionals manage client funds to ensure both the source and disposition of funds comply with regulations." Polymarket, through a spokesperson, said it is committed to accurate, fair and transparent markets and cooperates with regulators and law enforcement. The spokesperson said its market-integrity controls include procedures to detect, verify and address suspicious activity. Legal pressure is mounting on multiple fronts. The CFTC has sued the company, and people familiar with internal communications said employees were told to preserve records tied to the fraud attack and other matters. The New York City Council has opened a broad inquiry into Polymarket and other prediction-market platforms. More than 20 traders have sued, alleging deceptive business practices. Separate state-level cases focus on whether Polymarket and rival Kalshi are operating unlicensed gambling businesses. The outcomes could help define the industry's regulatory boundaries. Even as risks accumulate, Coplan has urged staff to maintain rapid growth. He is pursuing another $1 billion fundraising that would value Polymarket at about $21 billion. Donald Trump Jr.'s fund, 1789 Capital, is set to participate; the fund has previously invested about $200 million in Polymarket. Polymarket also has a data partnership with Dow Jones, publisher of The Wall Street Journal. People familiar with the company said it has been working to present itself to investors and the public as a more mature, sustainable-growth business. Since May, it has hired more experienced risk managers, including a former FBI agent, tightened compliance processes and improved product testing. Insiders said Coplan visited 1789 Capital cofounder Omeed Malik at his Hamptons home in late June to discuss operational upgrades ahead of a potential IPO next year, and Malik advised hiring more senior executives. Polymarket recently named its first chief financial officer, Warren Jenson, who served as Amazon's CFO in the early 2000s. After a Journal report on Polymarket's social-media betting operations, the company reorganized its marketing group and hired the founder of e-scooter company Bird as head of growth. Other staff connected to the social-media marketing effort either left or saw responsibilities reduced. A spokesperson said the company is scaling across finance, technology and culture while maintaining a focus on responsible growth. Former employees described Coplan, now 28, as blunt and authoritarian, with a hard-driving internal culture. They said late nights were common and some staff used Adderall, a controlled stimulant. Several former employees said Coplan routinely pushed engineers to ship from a constantly changing feature list. A recording reviewed by the Journal shows Coplan, during a July discussion last year about resolving betting-outcome disputes, saying: "Dude, this is ridiculous! It's absurd that you're constantly complaining about this." Polymarket's return to the U.S. In 2022, Polymarket settled with federal regulators and was barred from letting U.S.-based users access its international platform. As its profile rose in 2024, two federal agencies began investigating whether the company violated that settlement by allowing U.S. traders onto the platform. After the U.S. restriction, Coplan told employees to prepare for a comeback. The company laid groundwork for a U.S.-based app and negotiated with regulators over the ongoing probes. Last summer it spent $112 million to buy a licensed exchange and rebrand it as Polymarket US. The U.S. app opened to early users in December. People familiar with activity on the platform said traders poured in and total deposits exceeded $500 million. As an anti-money-laundering safeguard, Polymarket US initially used a standard rule in financial exchanges: funds deposited through a particular payment channel must be withdrawn back through the same channel. Without it, bad actors can deposit via stolen cards, trade, then cash out to clean accounts. Prediction markets are not federally required to enforce the rule, but many brokers and betting apps—including DraftKings and FanDuel—do. Kalshi does not, though insiders said it monitors cross-channel withdrawals and freezes suspicious payments. Fast withdrawals, rising fraud alarms In January, Polymarket's U.S. app still represented a small slice of the business: U.S. betting volume was under $3 billion versus more than $7.6 billion on its larger international platform. The U.S. product was in beta and available to a limited user set, but Coplan wanted to remove friction. Fast withdrawals became a priority. By February, Polymarket's Discord channels filled with complaints about delays. Staff told users that compliance checks could hold withdrawals up for days or weeks, and engineering issues compounded the backlog. Ahead of the 2025 New York City mayoral election, Polymarket ads appeared on city streets. In February, payment provider Checkout.com alerted Polymarket that fraudsters were attempting to link stolen debit cards to thousands of new accounts. People familiar with the attack said most deposit attempts failed and the activity largely traced back to seven users, including one who tried roughly 4,000 deposits. Checkout.com continues to work with Polymarket and declined to comment on the episode or the partnership. The surge overwhelmed Polymarket's compliance team and worsened the withdrawal queue. Insiders said management chose to drop the same-channel withdrawal rule to speed refunds, despite warnings from some employees that doing so would open a money-laundering vulnerability. Executives believed existing controls were sufficient. Former federal prosecutors have said weak controls over money laundering can trigger liability under federal anti-money-laundering statutes, illegal funds-transfer rules and even bank-fraud laws. The CFTC and DOJ have pursued similar cases against multiple firms, including crypto exchanges, with penalties sometimes reaching hundreds of millions of dollars. People familiar with the company said the anti-money-laundering obligations applied to Polymarket are comparatively light. A source said Polymarket US Chief Compliance Officer Andrew Clifford resigned after submitting a detailed fraud report in April. Clifford and Polymarket declined to comment. Around the same time, Polymarket closed a $1 billion funding round valuing it at nearly $15 billion, with Trump Jr.'s fund among the investors. Soon afterward, the company fired its U.S. division CEO, Justin Hertzberg, and the regional heads of regulatory and anti-money-laundering functions also departed. Hertzberg did not respond to requests for comment. According to people familiar with the review, law firm Sullivan & Cromwell concluded Polymarket's operations complied with regulatory requirements. By May, a source said, fraud rates had fallen back toward normal after limits on the number of debit cards per account and the adoption of fraud-prevention service Riskified. Product rollouts, platform disputes Former employees said Polymarket also struggled with problems tied to rapid feature releases and insufficient testing. Engineers who urged focusing on fixes for known vulnerabilities said Coplan sometimes directed them to use AI to build new features. Users have reported losses and account disruptions. A New York user said an app crash in July was followed by $950 missing from his account. A California user said $1,500 was stuck and could not be withdrawn. A 22-year-old in Massachusetts said the platform locked their account and, after dozens of contacts with support, they waited weeks without a response. Insiders said Polymarket has reimbursed some customers; others worked with banks to reverse unauthorized transactions. The company has also tightened code-review processes and hired more engineers. Coplan pushed for attention-grabbing markets. Text messages reviewed by the Journal show he floated ideas such as: "How many times will Kanye mention Jews on X this week?" and "Who will Elon insult next?" Neither went live. In June, Polymarket filed a trademark application for "Create Your Own Market." Former employees said it fits a long-term strategy to let users spin up prediction markets on virtually any topic. Barnard College economics professor Rajiv Sethi, who studies prediction markets, said user-created markets could heighten manipulation risks. Celebrity deals and investor unease Polymarket has pursued high-profile partnerships, including NBA star LeBron James, as Coplan aims to make the brand mainstream. Insiders said the company secured a $300 million collaboration with Major League Baseball and invested heavily in celebrity and athlete tie-ups. People familiar with prior discussions said LeBron James's representatives told a competing prediction-market firm that Polymarket offered $20 million per year plus $50 million in equity. The final terms of Polymarket's current deal could not be verified, and insiders said James does not currently hold Polymarket equity. Last fall, Polymarket discussed a multimillion-dollar partnership with musician Drake. Polymarket and Drake's team said no agreement was reached, though Drake later referenced Polymarket and Coplan in his album "Iceman." Coplan attended a private album launch in Toronto. In late April, Polymarket listed a market on whether Drake would say "Polymarket" on the new album. An account created shortly before release, focused only on album-related markets, ended with a $7,800 profit. According to insiders and data reviewed by the Journal, Drake's team played the album early for Polymarket employees. After hearing the company name, staff rushed to delist the market over insider-trading concerns. One person involved in partnership talks said returns from branding deals are hard to quantify and Coplan appeared uninterested in break-even math, focused on closing. When staff questioned whether an offer was too rich, Coplan responded: "I don't care at all." Executives at Intercontinental Exchange (ICE), Polymarket's biggest investor, told the Journal they were concerned about strategic missteps. A June Journal report said Polymarket paid influencers to post fake trading videos and ran offshore-platform ads aimed at U.S. users, raising concerns among ICE and other investors about potential violations of federal advertising rules and the CFTC settlement that bars offshore services for U.S. traders. In late July, ICE disclosed in its quarterly report that it holds $1.6 billion of Polymarket shares, equal to 22% of the company's outstanding equity. A second security incident In late July, nearly 500 users were hit by another fraud event tied to an engineering flaw, according to insiders. Attackers allegedly took over existing accounts—and linked bank and debit cards—by opening new accounts using other people's personal information, including stolen Social Security numbers, without needing a password or username. The amount stolen was described as relatively small. Polymarket said it will reimburse users for all losses. Several users said in interviews and on Discord that they lost thousands of dollars and received no customer-support response for weeks. A Polymarket employee said on Discord in July that engineers were working through affected cases. Dane Collins, 26, said he began betting on the World Cup through Polymarket US in May after Kalshi was blocked by a court order from offering sports betting in his home state of Michigan. In July, he said, he logged in to find all his positions liquidated and his $5,783.51 profit withdrawn to a debit card he did not recognize. Polymarket later deposited $25 into his account without explanation, he said. Collins said he filed reports with local police, the FBI and the CFTC. "Polymarket US has not responded for several weeks," he said. After he submitted identity documents twice, he said the platform froze his account without addressing the missing funds.