Polymarket's Payment Processor Was Rejecting 80% of US Deposits as Fraud. The CEO's Reported Answer: Keep Growing, Pay the Fine Later

The industry-standard fraud rejection rate for a payment processor is about 1% of deposits. At one point this spring, Checkout.com was rejecting more than 80% of the deposits it handled for Polymarket US.

That is not a fraud problem. That is a platform where fraud was the main customer.

According to a Wall Street Journal investigation published Sunday, the attack started in February 2026, not long after Polymarket relaunched in the United States. Fraudsters linked stolen debit cards to thousands of freshly created accounts, deposited, placed bets, and then tried to pull the winnings out to clean cards or accounts they controlled. Classic card-testing and cash-out, run through a federally regulated derivatives exchange. The Journal put the attempted haul at at least $10 million. It did not establish how much actually got through, and one person cited said most attempted deposits failed. The Block, summarizing the Journal’s reporting, says roughly seven users were behind the bulk of it and one of them attempted around 4,000 deposits.

Checkout.com is the one who raised the alarm. Polymarket’s compliance team took it to CEO Shayne Coplan. His reported reply is the reason this is a story.

”Keep Growing, Pay a Fine Later”

Per current and former employees who spoke to the Journal, Coplan, 28, told the team to focus on growth now and worry about regulatory fines later. Different outlets render the line slightly differently, and none of them have it from a document, so treat the exact wording as paraphrase. The gist across every version is the same: keep growing, and if regulators ever find out, pay the fine.

Polymarket has not confirmed those remarks. A spokesman told the Journal: “Our market integrity framework includes processes to detect, review and respond to suspicious activity.” The company also says an internal review by Sullivan & Cromwell concluded it complied with regulations.

What the company did do, per The Block’s readout of the Journal report, was drop a withdrawal safeguard that required money to leave through the same payment source it arrived from. That is the exact control that stops a stolen-card cash-out. Fraud stayed elevated for months. It did not normalize until May, after Polymarket limited how many debit cards a user could link and brought in the fraud-prevention firm Riskified.

Then the people who flagged it left. Chief compliance officer Andrew Clifford resigned in April, after submitting a report on the fraud. US CEO Justin Hertzberg was fired. The heads of US regulation and anti-money-laundering also departed.

Former CFTC enforcement lawyer Joe Konizeski’s summary to the Journal: “In the regulated space, this kind of thing does not happen.”

It Got Worse in July

The card fraud was not the only breach. In July, nearly 500 Polymarket accounts were taken over by attackers using stolen personal information, including Social Security numbers, to gain full access without ever needing a username or password. Some users lost thousands of dollars and waited days for support. Polymarket has said it will make those users whole.

That is the third security story we have written about this company since June. In late June it was a supply-chain attack on a frontend vendor that drained $3.1 million from 11 wallets. Now it is stolen cards and stolen identities, on the US-regulated side of the house, the part that is supposed to be the clean one.

The CFTC Is Now Involved. So Are a Dozen States

The Journal reports the Commodity Futures Trading Commission is investigating Polymarket, and employees have been instructed to preserve records related to the February attack “and other matters.” Polymarket US operates as QCX LLC, which the CFTC granted designated contract market status on July 9, 2025. The same agency fined the company $1.4 million in 2022 for running unregistered binary options, so this is a repeat customer.

Separately, New York City is examining Polymarket’s advertising, and more than a dozen states are probing whether it is running an unlicensed gambling operation. On the disclosure side, Polymarket says it has referred more than 90 accounts to authorities and reported over 315 wallet details this year.

Timing matters. The CFTC just filed its long-awaited crypto rulebook with the White House two days after the Senate killed the CLARITY Act, and it has spent the summer suing states over prediction-market jurisdiction on Kalshi’s behalf. An agency that is publicly fighting to be the sole regulator of this industry cannot afford for its flagship licensee to look like a stolen-card laundromat.

The $21 Billion Part

None of this has stopped the money. Polymarket is reportedly raising roughly $1 billion at a $21 billion valuation, with 1789 Capital, the fund where Donald Trump Jr. is a partner, putting in about $300 million on top of the $200 million it already invested. An IPO is being floated for 2027. The company just hired its first chief financial officer, former Amazon CFO Warren Jenson, and brought in ex-FBI agent Shauna Batista to run an investigations team.

For context, rival Kalshi is in talks at a $40 billion valuation and claims roughly 95% of US prediction-market revenue. Polymarket’s pitch to investors is that it can close that gap. The Journal’s story is that it tried to close it by turning off the fraud controls.

Why This Matters for Crypto Jobs

Strip the drama out and this is a case study in what happens when a company staffs growth before it staffs risk, and it lands right as prediction markets are the hottest hiring category in the industry.

• Compliance is the job that gets you fired for doing it. The CCO wrote the fraud report and was gone within two months. That is going to be the first question every serious compliance candidate asks Polymarket, Kalshi and every prediction-market startup pitching them: who do I report to, and what happened to the last person who escalated? Companies with a real answer will win the hiring.
• Payments fraud is now a crypto skill. Yesterday it was Visa merchant codes at Crossmint and Robinhood. Today it is card-testing at Polymarket. Every fiat on-ramp attached to a crypto product needs people who understand chargebacks, card-network rules, velocity checks and Riskified-style tooling. If you have run fraud ops at a fintech, prediction markets are paying.
• CFTC-registered means CFTC-staffed. A designated contract market is expected to have surveillance, AML and regulatory-reporting teams that look like an exchange’s, not a startup’s. Polymarket just lost its heads of regulation and AML and is under investigation. Those seats have to be refilled, and the people who fill them will have leverage.
• The $1 billion round will fund a lot of hiring. A new CFO, an ex-FBI investigations lead and a 2027 IPO target mean audit, finance, legal and trust-and-safety headcount. Polymarket’s fastest path to IPO-ready is hiring the people it reportedly ignored.

If you can build the controls a 28-year-old founder told his team to skip, this is your moment. Browse the latest crypto and Web3 jobs on Cryptogrind, including compliance, risk and payments roles at exchanges and prediction markets that would rather hire you now than pay the fine later.