Polymarket loosened anti-money-laundering rule during $10 million stolen-card attack, report says
A Wall Street Journal investigation found Polymarket removed an anti-money-laundering control while fraudsters exploited its U.S. platform in a $10 million stolen debit-card attack. In February, a payment processor flagged suspicious card activity funding Polymarket US accounts and alerted the chief executive. The stolen-card scheme involved attempts to fund wagers with fraudulent cards and withdraw winnings. Polymarket reportedly sacrificed security for growth, and employees raised concerns with leadership as losses mounted.
The episode gives the CFTC a concrete pattern to examine at the worst possible moment for Polymarket. A chief executive who heard direct fraud warnings and responded by loosening controls, rather than halting traffic, invites structural penalties that go far beyond any single fine. For traders, the risk is operational disruption: a consent order mandating transaction monitoring and compliance hires would slow platform development while rival Kalshi pushes deeper into sports contracts with more capital on hand.
Every CFTC-registered platform will absorb the compliance bar this episode sets, but Polymarket bears the cost of defining it. The CFTC now has a specific pattern to examine from the CEO's alleged direction to staff, and the first enforcement template will shape how quickly rivals must match hardened controls.