Polymarket Hit by $10M Stolen Card Fraud Attempt, Overhauls Compliance Before $1B Raise

A $10 million fraud scheme using stolen debit cards struck Polymarket in February 2026, triggering a compliance overhaul at the prediction market platform just as it pursues one of the largest funding rounds in its history.

The attack involved fraudsters attempting to deposit funds through stolen payment credentials. Polymarket's payment processor flagged and rejected more than 80% of those deposits, limiting the realized losses, but the sheer scale of the attempt exposed gaps in the platform's fraud controls. The incident has since prompted an internal compliance restructuring, the details of which have not been fully disclosed.

The timing could hardly be more consequential. Polymarket is currently seeking $1 billion in new funding, a raise that would vault it into a narrow tier of crypto-native companies commanding that level of institutional capital. Fraud incidents of this magnitude typically surface in investor due diligence, and they invite pointed questions from venture firms and regulated financial partners about operational safeguards, KYC (know your customer) and AML (anti-money laundering) protocols, and the platform's relationship with payment rails. That 80% rejection rate cuts both ways: it demonstrates that existing fraud detection systems had some teeth, but it also confirms that roughly $2 million in fraudulent transactions cleared before controls intervened.

Polymarket has navigated regulatory headwinds before. The platform, which runs a decentralized prediction market allowing users to bet on real-world events, settled with the U.S. Commodity Futures Trading Commission in 2022 for $1.4 million over charges that it offered illegal binary options contracts to U.S. customers. It subsequently geoblocked American users, a restriction it has since worked to reverse through a U.S.-facing product. That history means regulators already have Polymarket in their peripheral vision. A nine-figure fraud attempt, even one largely intercepted, is the kind of event that moves it back to center frame.

"Polymarket US reportedly faced a $10 million stolen-card fraud attempt in February, with a payment processor rejecting over 80% of deposits."

Prediction markets occupy an awkward regulatory position in the United States, sitting at the intersection of commodities law, gambling statutes, and financial services regulation. Platforms that process fiat deposits through debit and credit cards are subject to the same payment card industry standards and chargeback liability frameworks as any other merchant, and a coordinated stolen card attack generates chargeback exposure that can damage processor relationships. Losing access to payment processors would be an existential problem for a platform trying to onboard retail users at scale.

For prospective investors, the compliance overhaul Polymarket is undertaking may actually serve as a positive signal, provided it is substantive. Institutional limited partners and co-investors have become considerably more rigorous about evaluating portfolio companies on operational risk since the FTX collapse in late 2022 accelerated regulatory scrutiny across the sector. A platform that identifies a vulnerability, responds with documented remediation, and discloses the incident during a fundraise is in a stronger position than one that conceals it. The question is whether the overhaul addresses root causes or merely adds procedural layers.

What the February incident underscores is the structural challenge facing any prediction market that operates at scale with fiat on-ramps. Decentralized settlement does not insulate a platform from the fraud vectors that come with centralized payment processing. Polymarket's ability to close its $1 billion round, and to do so on favorable terms, will depend in part on how convincingly it can demonstrate that its compliance infrastructure has caught up to its ambitions.