TheChek News Flow

CEO Shayne Coplan brushed off concerns about scheme involving stolen debit cards; now the prediction market is bolstering executive ranks as it eyes IPO

Polymarket US faced a major fraud attack in February where thieves linked stolen debit cards to accounts and tried to steal at least $10 million.

CEO Shayne Coplan reportedly brushed off employee concerns about the fraud, telling compliance staff to keep growing and pay any regulatory fines.

The company is facing investigations by the CFTC and the New York City Council, alongside lawsuits challenging its business practices.

In February, a company processing debit-card transactions for Polymarket’s U.S. betting platform delivered some alarming news: Fraudsters were flooding the app.

Users were linking stolen debit cards to Polymarket US accounts, then trying to use them to make wagers and withdraw the money into clean cards or accounts they controlled. Thieves tried to make off with at least $10 million.

At one point, the processor rejected as fraudulent more than 80% of the deposits it was handling, a rate that far exceeded industry standards of roughly 1%. Polymarket employees quickly raised their concerns with Chief Executive Shayne Coplan, according to people familiar with the events.

The compliance team, those people recalled, was floored by Coplan’s response: Just keep growing and pay a fine if regulators ever find out.

Current and former employees said Coplan’s reaction, which hasn’t previously been reported, was characteristic of his plan for Polymarket—growth at all costs.

Polymarket is doing everything in its power to woo new users and investors. In the process, said current and former employees and investors interviewed by The Wall Street Journal, the highflying company has struggled with compliance failures, legal challenges and software blunders.

Rates of fraud remained elevated for months after the February attack, people familiar with the matter said, though they didn’t again reach 80%. In the wake of the incident, executives left and an internal investigation began.

Former regulators from the CFTC, Justice Department and Internal Revenue Service said the level of attempted fraud and Polymarket’s response was atypical for the commodities and gambling industries. Unlike traditional commodities exchanges, Polymarket accepts funds directly from retail traders, making it more vulnerable to fraud attacks.

“In the regulated space, this kind of thing does not happen,” said former CFTC enforcement lawyer Joe Konizeski. “You have adults who handle customer funds and make sure they’re sourced appropriately and handled appropriately.”

A Polymarket spokesman said the company is committed to maintaining accurate, fair and transparent markets and working with regulators and law enforcement. “Our market integrity framework includes processes to detect, review and respond to suspicious activity,” the spokesman said.

Polymarket’s legal challenges are mounting on several fronts. The Commodity Futures Trading Commission is investigating it, and employees have been told to retain records related to the fraud attack and other topics, according to people familiar with the matter. The New York City Council is probing the advertising practices of Polymarket and other prediction markets, and Polymarket has been accused in lawsuits of deceptive business practices by almost two dozen traders.

At the same time, more than a dozen state lawsuits are focusing on whether Polymarket and its prediction market competitors such as Kalshi and Coinbase are unlicensed gambling platforms. The outcome of those cases could reshape the industry.

As legal risks pile up, Coplan is in the process of raising $1 billion, in a fundraising round that would value the company at around $21 billion. Donald Trump Jr.’s investment fund 1789 Capital is investing roughly $300 million in the round, in addition to the roughly $200 million it has previously invested.

Polymarket, which has a data partnership with Dow Jones, the publisher of The Wall Street Journal, has been working to reposition itself to investors and the general public as a more mature company focused on responsible growth. Since May, it has added experienced risk-management staffers, including a former FBI agent. The company has improved its compliance protocols and improved product testing, according to a person familiar with operations.

In late June, Coplan visited the Hamptons home of 1789 Capital co-founder Omeed Malik to strategize about how to professionalize Polymarket’s operations before a potential initial public offering in the next year, according to people familiar with the meeting. Malik advised Coplan to hire more experienced executives. Polymarket recently hired its first chief financial officer, Warren Jenson, who was Amazon’s CFO in the early 2000s.

Following a Journal investigation into a deceptive social-media campaign, Polymarket restructured its marketing team, including hiring the founder of electric-scooter company Bird as chief of growth. Other marketing employees involved in the social-media campaign have left the company or had their roles shrink.

“Polymarket is rapidly growing and getting better every day,” a spokeswoman for the company said. “We are proud of our key leadership hires and continuous infrastructure upgrades and we have quickly scaled and remain focused on growing responsibly at the frontier of finance, tech, and culture.”

The 28-year-old Coplan has a reputation for being unfiltered and intense. He has berated employees in the office. Former staffers said employees worked late nights and that Adderall use was widespread. Coplan has pressed engineers to push out a shifting list of new features, some former employees said.

Last July, during a discussion about how to resolve disputes over the outcome of bets, Coplan shot back, “Bro, it’s just retarded! And the way you guys bitch about this s— is so stupid,” according to a recording reviewed by the Journal.

Polymarket has been barred from offering its international platform to American users since a 2022 settlement with federal regulators. In 2024, as Polymarket’s profile grew, two federal agencies investigated whether the company was violating that settlement by allowing U.S. traders on its platform.

Around that time, an office prankster briefly erected a life-size cardboard cutout of imprisoned crypto fraudster Sam Bankman-Fried—a joke partly about how similar Coplan, a fellow crypto billionaire, is in appearance.

Coplan told employees to prepare for a U.S. homecoming. Polymarket laid the groundwork for an American app and negotiated with regulators to end the investigations. Last summer, it paid $112 million for a licensed exchange that they converted into Polymarket US.

Polymarket US opened to early users in December. Traders flocked to the platform and deposited over a half-billion dollars into their accounts, according to a person familiar with the matter.

As one part of its protection against money-laundering attacks, Polymarket US employed a rule commonly used by financial exchanges: Funds deposited from one payment source were required to be withdrawn to that same source. Without such a rule, a thief could deposit money using stolen debit cards, trade with it, then withdraw winnings to a clean card.

Federal regulations don’t require prediction markets to follow that rule. Other brokerages and betting apps, including DraftKings and FanDuel, do so. Polymarket’s chief competitor, Kalshi, doesn’t, though that company inspects funds withdrawn to different payment mechanisms and freezes suspicious payments, a person familiar with that company’s protocols said.

Fraud warning

By January of this year, Polymarket’s US app was handling only a fraction of the volume of its mammoth international exchange: less than $300 million in betting activity compared with more than $7.6 billion on the international platform.

Coplan wanted any potential friction for users gone, even though the app was still in beta testing and had launched to only a limited number of users.

Near the top of his list: Making sure users got their money quickly. By February, a Discord chat for Polymarket users had filled with complaints about how long it took to withdraw funds. Employees reassured users that their money was in transit, but that compliance checks could hold it up for days or weeks. Engineering glitches on the U.S. app added to the pain.

In February, the swindlers attacked Polymarket, linking stolen debit cards to thousands of new accounts, the payment processor Checkout.com told Polymarket. Most of the attempted deposits failed, said one person familiar with the matter, who attributed the majority of the attack to seven users, one of whom attempted about 4,000 deposits. Checkout.com, which continues to work with Polymarket, declined to comment on the incident or its relationship with Polymarket.

The attack overwhelmed the compliance staff, backing up withdrawals further. To get money back to customers faster, company leadership decided to scrap the rule requiring same-source withdrawals, even though some employees warned that it could open the door to money laundering, according to people familiar with the discussions. Executives maintained that other protocols in place were sufficient.

Failure to adequately police money laundering could violate federal laws about money laundering, illicit transmission and possibly bank fraud, former federal prosecutors said. The CFTC and Justice Department have prosecuted firms—including crypto exchanges BitMEX and Binance—for violating such laws, and some fines have extended into the hundreds of millions of dollars. Polymarket is subject to less stringent anti-money-laundering regulations.

Polymarket US’s chief compliance officer, Andrew Clifford, resigned in April after sending a lengthy report with an overview of some of the fraud issues to company executives, according to people familiar with the report. Both Clifford and Polymarket declined to comment about his departure.

Around that time, Polymarket closed a $1 billion investment round that valued the company at nearly $15 billion. Investors included Trump Jr.’s 1789 Capital.

Soon after, Polymarket fired the U.S. division’s CEO, Justin Hertzberg, and its heads of U.S. regulation and anti-money-laundering left. Hertzberg didn’t respond to requests for comment. An investigation by the law firm Sullivan & Cromwell concluded the company had complied with regulations, according to people familiar with the findings.

By May, Polymarket had brought fraud rates back to the industry norm, a person familiar with the matter said, in part by limiting the number of debit cards users could link to their accounts. The company also retained a new antifraud contractor, Riskified.

Provocative new markets

Polymarket also has been trying to fix other problems stemming from the minimal testing it had done before rolling out new features. The company had often pushed untested updates to users, according to former employees. When engineers objected, saying they should focus on fixing existing platform issues, Coplan sometimes told them to build them with AI instead, former employees said.

A New York man said he found $950 was missing from his account after the app crashed in July. A California woman said she hasn’t been able to withdraw $1,500 from her account. A 22-year-old in Massachusetts reported having his account locked and not hearing back after dozens of attempts to reach Polymarket employees. Weeks went by without them hearing from the company.

Polymarket has reimbursed some customers who suffered losses, while others have worked with their banks to reverse unauthorized charges, said a person familiar with the matter. Recently, it has improved its code-review practices and hired more engineers.

Coplan has pushed employees to create provocative new markets. In text messages reviewed by the Journal, he suggested markets on “How many times does kanye say Jew on X this week” and “Elon calls someone new a retard.” (Those markets were never listed.) In June, the company filed a trademark application for “create your own market,” a step toward what former employees say is one of Coplan’s long-desired growth plays—to let people list markets on whatever interests them.

Letting users create their own markets could introduce new opportunities for market manipulation, said Rajiv Sethi, a Barnard College economics professor who has studied prediction markets.

Coplan’s push to make Polymarket a household name led to expensive deals with A-list celebrities and sports stars, including LeBron James and a $300 million deal with Major League Baseball.

James’s team told a prediction-market competitor that Polymarket had offered him $20 million a year, plus $50 million in equity, according to a person familiar with the talks. The final terms of the deal with Polymarket couldn’t be learned. James doesn’t currently have an equity stake in Polymarket, a person familiar with the matter said.

Last fall, Polymarket was in talks with the musician Drake about an agreement in the tens of millions of dollars, according to people familiar with the talks.

Spokespeople for Polymarket and Drake said the parties didn’t sign a deal. The musician subsequently name-dropped both Polymarket and Coplan in his album “Iceman.” Coplan attended Drake’s private album-release party at a castlelike mansion in Toronto.

In late April, Polymarket opened a market on whether Drake would say “Polymarket” on the album, one of many markets it launched related to that album. A single trader, whose account was created shortly before the album dropped and bet only on album-related markets, cashed out $7,800 in bets that he would. Hours before the album release, Drake’s team played it for Polymarket employees, who heard the mention of the company and deleted the market out of concern that it presented an insider-trading risk, according to data reviewed by the Journal and a person familiar with the matter.

While brand partnerships can be hard to precisely value, Coplan seemed uninterested in analyzing whether the deals would pay off, said a person involved with the deals, focusing instead on locking up partnerships. When employees questioned whether Polymarket had paid too much for a deal, the person recalled Coplan responding, “I don’t give a f—.”

Some senior employees at Intercontinental Exchange, Polymarket’s largest investor, said in interviews they are worried that the prediction company has made strategic errors. The Journal’s reporting in June that Polymarket was paying influencers to promote videos of fake trades—and target U.S. users with advertisements of its offshore platform—raised alarm bells at ICE and other investors concerned about federal advertising laws barring deceptive marketing and Polymarket’s agreement with the CFTC not to offer its offshore platform to U.S. traders, according to people familiar with the matter.

At the end of July, ICE disclosed in its quarterly financial report that its $1.6 billion stake in Polymarket amounted to 22% of shares outstanding of the company.

Another attack

In late July, nearly 500 Polymarket users were victims of another fraud attack that appeared to exploit an engineering flaw. If a malicious actor attempted to create a new account using an existing trader’s personal information, such a stolen Social Security number, the hacker would immediately gain access to the trader’s existing Polymarket account—and any of their linked bank accounts and debit cards—without needing to know a password or username, according to a person familiar with the matter, who said the amount of money stolen was small.

A Polymarket spokeswoman said that the company would cover any lost funds.

In interviews with the Journal and posts on the messaging app Discord, users described losing thousands of dollars. They said weeks of messages to Polymarket customer support went unanswered, though a Polymarket employee wrote on Discord in July that the engineering team was working on fixes to user issues.

Dane Collins, 26, said he started using Polymarket US in May to bet on the World Cup, after rival Kalshi was blocked by a court order from offering sports markets in Michigan, where he lives. In July, he logged in to see that his bets had been sold and $5,783.51 in gains withdrawn to a debit card he didn’t possess.

Without explanation, Polymarket credited his account $25. Collins said he has filed reports to his local police, the FBI and the CFTC. “Polymarket US was silent for weeks and weeks,” he said. Polymarket US’s support has since placed Collins’s account on hold after he submitted verification information twice. They have not mentioned the missing funds.