Bitcoin (BTC) Steady as Polymarket Hit by $10M Stolen-Card Fraud

$10M in Stolen-Card Deposits

Prediction-market operator Polymarket was hit by an attempted payment-fraud wave of at least $10 million on its United States platform, executed with stolen debit cards, and the fallout has reached the top of the company. The scheme came to light in a Wall Street Journal investigation published on Friday, built on interviews with current and former employees. Fraudsters registered thousands of Polymarket accounts, funded them with money drawn from stolen debit cards, placed bets, and then tried to route winnings back out to clean accounts and cards under their own control. Seven users drove the operation, and a single account holder attempted more than 4,000 separate deposits during the episode. The pressure landed squarely on Polymarket's payments processor: at one point, more than 80% of the deposits Checkout.com handled for the platform were flagged as fraudulent, far above the roughly 1% rate considered standard across the card industry. Visa issued a warning over the spike, after which Checkout.com demanded that Polymarket accept stronger transaction controls. The internal reaction was turbulent. Chief executive Shayne Coplan, after receiving internal reports, told staff that the priority was growth and that any regulator fines could be dealt with later, per the investigation. Andrew Clifford, the chief compliance officer, has since resigned, and several senior US-side executives — including the head of the American entity — were replaced or dismissed. The company has not disclosed how much of the attempted $10 million actually settled as losses. Polymarket, which lets users bet on real-world outcomes including Bitcoin (BTC) price ranges and settles wagers on blockchain rails, is pushing its US expansion, which raises the stakes for its compliance stack. Bitcoin (BTC) itself traded near $82,000 in the latest market snapshot, with the story doing little to disturb broader risk appetite.

Polymarket Pushes Back on the Account

Polymarket disputes the way its internal handling has been portrayed. The company says it has built systems to detect, investigate and respond to suspicious activity, and that it cooperates with regulators and law enforcement. It also points to remediation taken after the February scheme: the platform limited how many debit cards can be linked to an account and brought in Riskified, an established fraud-screening provider that builds chargeback and payment-risk tooling for large merchants, to review transactions before they settle. Neither the realized loss from the attempted $10 million nor the full scope of the cleanup has been published — the investigation did not report a final tally of successful withdrawals, leaving the actual damage unquantified and the market working from the company's stated measures rather than audited outcomes. The February attack was not the only incident. In July, a separate episode built on stolen personal information affected about 500 users, which underscores that exposure runs through more than one channel: card-based payment fraud on the deposit side and identity-based compromise on the account side. The distinction matters for how the risk is priced. Card fraud concentrates pressure on processors and banks, where chargeback ratios above the roughly 1% industry norm trigger fines and tightened terms — and Visa's warning meant the card network itself, not just the processor, was watching. Identity compromise concentrates pressure on user trust and data handling. Speculative corners of crypto show how varied the abuse surface is — from memecoin mania that draws stolen funds, to schemes like cryptojacking that hijack computing power — and prediction platforms add card-heavy fiat on-ramps to the mix. As Polymarket works to expand its US business, both channels sit under a brighter spotlight: payment partners and state regulators watch fraud ratios closely, and a repeat episode could carry harder consequences than executive reshuffling. Readers tracking the market in real time can follow live spot and futures prices on Bybit.

Compliance Reckoning Ahead

The two episodes trace a single arc: as prediction markets scale, abuse follows the money through the fiat side. COINOTAG's view is that the load-bearing record here is Polymarket's own remediation — the card-linking caps and the Riskified integration — because those steps confirm the company judged the threat material enough to change product behavior. Notably, chain-level security was never the problem: Bitcoin (BTC) runs on proof-of-work and the settlement layer held; the card on-ramp was the soft link. Until a realized-loss figure is disclosed, the open question is how much of that $10 million attempt actually stuck. For users weighing venue risk more broadly, our guide to the best crypto exchanges covers how major platforms screen deposits and withdrawals.