Invest1 publisher2 min readPublished
Polymarket's fraudulent deposits reportedly peaked at 80 times the industry norm
A payment processor flagged at least $10m of stolen-card deposits in February 2026. The only penalty on Polymarket's record is the $1.4m the CFTC took in 2022, before the registered US venue it now runs existed.
The Investor · Invest desk
What happened
- CEO Shayne Coplan allegedly told staff to keep prioritising growth, suggesting any regulatory penalty would be a manageable cost of doing business.
- Multiple executives have departed in the wake of the incident, and the company started an internal investigation.
- A 2022 CFTC case cost Polymarket a $1.4 million penalty for operating unregistered event markets and barred US users from the platform under the settlement.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- exposure The CFTC-regulated venue launched in late 2025 is what lets Polymarket take American money at all, so an enforcement response this time can reach that permission itself.
- precedent A $1.4 million penalty against at least $10 million of fraudulent flow was smaller than the fraud itself, so any future CFTC penalty has to be considerably larger to deter.
- decision Traders holding balances, and the processor that raised the alarm, have to decide whether to keep funding a venue whose verification failed at this scale while the internal investigation is unfinished.
- contradiction How severe the 80% figure is depends on which denominator is meant, since deposits and total volume are different measures, and on what window the peak covers.
Treating a penalty as a cost of growth works only when the penalty is money [1]. The $1.4 million the CFTC took from Polymarket in 2022 came with a restriction barring US users from the platform [7], and the company did not launch a CFTC-regulated version again until late 2025 [8]. Set that fine against the at least $10 million of stolen-card deposits the processor flagged in February 2026 [3] and it works out at about 14 cents for every dollar at issue [12].
The 80 percent needs a denominator. Crypto Briefing gives the peak as fraudulent deposits exceeding 80 percent of total volume, and does not say over what period the peak was measured [16]. Take it at face value and legitimate flow was under a fifth of the total, so fraudulent money moved at more than four times the rate of real money [14]. Against a roughly 1 percent industry norm, the ratio is about 80 to 1 [13].
The scheme ran on unauthorized use of stolen debit cards to move money onto the platform [4]. According to reports cited by Crypto Briefing, the exposure continued for months after the processor's alarm while leadership kept pushing growth [5]. Multiple executives have since departed and an internal investigation is open [6].
Other readings are live. The remark attributed to Shayne Coplan is an allegation reported second hand, not a quotation [1], and stolen-card attacks on a newly launched card deposit rail are an ordinary payments problem for a venue that drew as much traffic as Polymarket did during the 2024 US election cycle [11]. If the investigation shows deposits were shut within weeks, the 80 percent peak describes a few weeks of a new rail.
The third reading is the one I would weight highest. If the CFTC treats the growth directive as the violation, the size of the fraud is no longer what sets the penalty. Crypto Briefing wrote that the agency now has fresh ammunition if it chooses to revisit the company's regulatory standing [10], and standing is what the late-2025 launch bought [8].
Polymarket is meanwhile spending its first year as a regulated US venue on an internal investigation and a thinned executive bench [6], with regulators already looking at insider trading and marketing practices [9]. What would prove this reading wrong is a dated remediation record showing card deposits blocked soon after the February 2026 flag [3], plus a CFTC response that goes no further than a fine.
What to watch
- Whether the internal investigation produces a dated record of when card deposits were actually blocked after the February 2026 flag.
- Any CFTC action that touches Polymarket's registered US venue itself.
- Whether the payment processor continues to support card-funded deposits on the US platform.