The world's largest prediction market is facing a serious accountability reckoning. According to a Wall Street Journal investigation, Polymarket CEO Shayne Coplan brushed aside warnings about a $10 million fraud attack, allegedly telling compliance staff to keep growing and pay a fine later if regulators ever caught on. The US Commodity Futures Trading Commission (CFTC) has now opened an investigation. Here's what's alleged, and why it matters for a platform betting billions on going legitimate.
A note on sourcing: the core allegations below come from a Wall Street Journal investigation published September 20, based on people with knowledge of the events. Polymarket disputes the characterization. Treat the specific claims as reported allegations, not established fact.
What allegedly happened
According to the WSJ, fraudsters began targeting Polymarket's US-facing platform in February 2026, months after the regulated service began admitting users from its waitlist. The scheme was straightforward but large: thieves linked stolen debit cards to thousands of Polymarket US accounts, used them to place bets, then tried to withdraw the proceeds to "clean" cards or accounts they controlled, attempting to steal at least $10 million.
The scale of the fraud was staggering. At the height of the attack, Polymarket's payment processor, Checkout.com, rejected more than 80% of the platform's US deposits as fraudulent, a figure that dwarfs the roughly 1% considered typical across the industry.
The quote at the center of it
When compliance staff escalated their concerns to Coplan, his response, according to people familiar with the situation cited by the WSJ, was to keep growing and pay a fine if regulators found out. Employees described being stunned, and current and former staff characterized the reaction as typical of a broader "growth at all costs" culture at the company.
More concerning from a regulatory standpoint: Polymarket reportedly loosened a standard anti-money-laundering safeguard during the attack, removing the requirement that funds be withdrawn through the same payment method used for deposits, a control designed specifically to prevent the kind of "deposit dirty, withdraw clean" laundering the fraudsters were attempting. Employees reportedly warned this change could increase money-laundering risk.
The fallout
The internal consequences were significant. Polymarket's chief compliance officer, Andrew Clifford, resigned in April after sending executives a report detailing the fraud issues. The US division's CEO, Justin Hertzberg, was later fired, and the heads of US regulation and anti-money-laundering also departed, a near-total turnover of the platform's US compliance leadership.
The CFTC has now opened an investigation, instructing Polymarket to preserve records tied to the fraud attack and other matters. (The agency told The Block it could "neither confirm nor deny" an investigation, standard regulatory language.) Former federal prosecutors interviewed by the WSJ warned that weak anti-money-laundering safeguards risk running afoul of federal statutes covering money laundering and illicit fund transfers.
For its part, Polymarket has pushed back. A law firm it hired to investigate, Sullivan & Cromwell, concluded the company had acted in compliance with applicable regulations, and a spokesperson told reporters the company is "focused on growing responsibly at the frontier of finance, tech, and culture." Notably, Polymarket contained the attack by May 2026 after implementing deposit caps per card, and fraud rates returned to normal.
Why the timing is brutal
The investigation lands at the worst possible moment for Polymarket. The company is seeking roughly $1 billion in financing at a valuation of around $21 billion, and it only returned to the US market this year after acquiring a CFTC-registered exchange to secure a license, following years of being barred. Prediction markets have exploded into a multi-billion-dollar sector (combined monthly volumes reached tens of billions this year), and Polymarket's entire pitch to investors and regulators rests on being the legitimate, compliant leader. Allegations of a "pay the fine later" culture directly undermine that story. This also isn't the first scrutiny: earlier reporting found Polymarket paid creators to stage fake bets on replica sites, and the platform has a prior CFTC settlement in its history.
For the crypto and prediction-market world, this is a significant accountability story. Prediction markets have been one of the industry's breakout successes, and Polymarket its poster child, so allegations that its leadership prioritized growth over fraud controls cut to the heart of whether the sector can be trusted at scale. For users, it's a reminder that a platform's popularity and even its regulated status don't guarantee its internal controls are sound. And for the broader push to legitimize crypto-native platforms, it's an unwelcome data point: at the exact moment the industry is arguing it can self-regulate responsibly, one of its flagships is under investigation for allegedly doing the opposite. The outcome of the CFTC probe, and whether it affects Polymarket's billion-dollar raise, will be worth watching closely.
