Fraudsters attempted to steal at least $10 million from Polymarket’s U.S. platform using stolen debit cards, exposing weaknesses in deposit screening, withdrawal controls and customer-account protection.
Attackers reportedly linked stolen cards to Polymarket accounts, placed wagers and attempted to move proceeds to accounts or cards they controlled. Checkout.com, the platform’s payment processor, at one point rejected more than 80% of the deposits it reviewed as fraudulent, according to The Wall Street Journal and The Block’s summary of the investigation.
Approximately seven users were responsible for most of the February attack. One reportedly attempted around 4,000 deposits. The reporting did not establish how much of the attempted $10 million theft succeeded, although most deposits were said to have failed.
Polymarket later removed a control requiring funds to be withdrawn to the same payment source used for the deposit. That safeguard is commonly used to prevent stolen-card proceeds from being routed into a clean account.
A second security incident occurred in July. Attackers reportedly used stolen personal data, including Social Security numbers, to access almost 500 accounts without knowing the customers’ existing usernames or passwords. Some users reported losing thousands of dollars.
Polymarket says it has strengthened fraud detection, leadership and product testing. An internal investigation by Sullivan & Cromwell reportedly concluded that the company complied with regulatory requirements, while fraud rates returned to more typical levels after debit-card restrictions were added.
TOKEN RECON ASSESSMENT
The incident combined payment fraud, identity theft and account-registration weaknesses.
Prediction-market operators hold payment credentials, bank links and personal information in addition to trading balances. Their security standard must therefore extend beyond smart contracts and market settlement.
Watch customer reimbursements, the final amount stolen, regulatory findings, identity-verification changes and whether same-source withdrawal requirements are restored.
Sources
The Wall Street Journal: Polymarket fraud and control failures
