Polymarket's February deposit rejections ran at eighty times the industry rate

A Sept. 19 report said fraudsters used stolen debit cards on Polymarket's U.S. platform in February to attempt at least $10 million in illicit withdrawals and wagers.

The Wall Street Journal reported that criminals connected stolen cards to thousands of Polymarket US accounts, funded them and then tried to move the money through trading before withdrawing it to cards or accounts they controlled.

At the peak of the February attack, payment processor Checkout.com rejected more than 80% of deposits it handled for Polymarket as fraudulent, according to the Journal.

Polymarket has not publicly confirmed that Coplan made the remark.

The $10 million figure represents the amount fraudsters allegedly tried to move, not a confirmed loss suffered by customers or Polymarket, and public reporting reviewed by crypto.news does not provide a final amount successfully withdrawn through the February scheme.

Elevated fraud continued for several months after February, though rejection rates did not return to the peak recorded during the first wave.

By May, fraud rates had reportedly moved back toward normal industry levels after Polymarket limited how many debit cards users could connect to their accounts and brought in Riskified as an outside antifraud provider.

Riskified provides automated fraud-decision systems combining machine-learning risk scoring with merchant transaction controls, and has not publicly disclosed Polymarket-specific fraud numbers.

The Journal reported that Polymarket initially required some withdrawals to return to the same payment source that had funded an account, and later loosened that restriction, citing employees who raised concerns about financial-crime risks.

Polymarket recently hired Warren Jenson as CFO while expanding compliance, investigations and risk management staffing.

Polymarket's current U.S. rulebook gives the exchange authority to restrict accounts, place customers into liquidation-only status and take other steps to protect customers and market integrity; the CFTC filing containing the March 20 version was certified in April.

The CFTC's current register lists QCX LLC, doing business as Polymarket US, as a designated contract market; QCX received its designation in July 2025 before operating under the Polymarket US name.

Polymarket US is legally separate from the company's international blockchain-based prediction market.

Polymarket told the Journal that it maintains procedures to identify and respond to suspicious activity and remains committed to cooperating with regulators and law enforcement.

The gap between the February peak and the May return toward industry norms is roughly three months.

The 80% figure has not been independently confirmed by Checkout.com in a public statement reviewed for the crypto.news report.

Checkout.com provides merchants with fraud-scoring, transaction-filtering and authentication tools, while its current service terms state that merchants remain responsible for deciding whether transactions are accepted or canceled.

An earlier report from The Information described prediction-market operators, including Polymarket, strengthening card-fraud controls after criminals used stolen payment credentials and fake identities to create accounts, and said Visa pushed payment processors to tighten screening as disputed transactions increased.

A rejection rate above 80% is about eighty times the roughly 1% industry level the Journal cited.

If more than 80% of deposits were rejected, fewer than 20% were approved, so at least four deposits were blocked for every one that funded an account.