Polymarket Bug Reportedly Let Identity Thieves Into Existing Accounts
The flaw apparently exposed accounts and the cards and bank links attached to them.
BY
KYLE TORPEY PUBLISHED SEPTEMBER 20, 2026, 2:23 PM ET
READING TIME 5 MINUTES
© PJ McDonnell via Shutterstock
READ LATER
COMMENTS (4)Nearly 500 Polymarket US users were hit in late July by a fraud attack that did not require a password, a username, or a compromised phone,
according to a Wall Street Journal report published Saturday. A person who tried to create a new account with an existing trader’s personal information, such as a stolen Social Security number, was reportedly dropped into that trader’s live profile. Linked bank accounts and debit cards also became accessible, the report says.
With the seemingly constant drumbeat of new data breaches taking place these days, the ability to access someone else’s account by effectively using personal data as a password is an incredible security vulnerability. Just a few weeks ago,
153 million driver’s licenses were put on sale following the breach of an identity verification company.
The Journal, citing a person familiar with the matter, described the episode as an engineering problem and indicated the total amount stolen via the exploit was small. However, users told a different story in interviews with the media outlet. They described losses in the thousands of dollars and weeks of unanswered support messages.
One Polymarket user in the U.S. told the Journal he joined the prediction market platform to bet on the World Cup. In July, he logged in to find his positions sold and $5,783.51 in gains sent to a debit card he did not own. Polymarket credited his account $25 and offered no explanation. The user said he filed reports with local police, the FBI, and the Commodity Futures Trading Commission (CFTC). “Polymarket US was silent for weeks and weeks,” he said. Support later put his account on hold after he submitted verification information twice but still did not address the missing funds.
A Polymarket spokeswoman told the Journal the company would cover lost money from the incident. The company has not published a public postmortem on the signup flaw.
Growth at Any Cost
The July attack sits inside a broader picture the Journal painted of a company that treated fraud acceptance as a cost of scaling. In February, payment processor Checkout.com warned Polymarket that thieves were tying stolen debit cards to thousands of new U.S. accounts, funding wagers, and trying to pull the money onto clean cards or accounts they controlled. Attempted theft ran to at least $10 million. At one point Checkout.com rejected more than 80% of the deposits it was handling as fraudulent, against an industry benchmark of roughly 1%.
Employees took the problem to CEO Shayne Coplan, but the compliance team’s recollection of his answer was that Coplan said to keep growing and pay a fine if regulators ever find out.
Fraud rates stayed elevated for months after February. By May, the Journal said, they had returned to industry norms after Polymarket limited debit cards per account and brought on antifraud contractor Riskified. Some customers were reimbursed while others clawed money back through their banks.
Polymarket and Kalshi’s Many Controversies
The July identity flaw was not Polymarket’s only security problem this year. In June the company said a compromised third-party vendor had
injected a malicious script into its website frontend for some users. Blockchain monitors put the resulting drain of funds from the hack at about $3.1 million in PUSD, Polymarket’s dollar token, across at least 11 wallets. Polymarket said it removed the dependency and would refund affected users in full. Head of experience William LeGate wrote on X that there were “no user ‘losses’” because of those refunds.
That incident landed in the same week as a separate Wall Street Journal report that Polymarket had paid social media creators to film fake winning trades on replica versions of its site.
Insider trading has also been a seemingly non-stop issue with prediction market platforms like Polymarket and Kalshi. In May,
a Google engineer was charged over a run of Polymarket wagers on Google’s most-searched people that prosecutors say relied on internal search data.
Campaign staffers have described using unreleased internal polls to trade before the numbers hit the public. Even George Santos is accused of betting against his own appearance at the State of the Union after posting that he would attend,
a case Kalshi referred to federal authorities. Of course, the most troubling cases involve military operations in
Venezuela and
Iran.
Both Polymarket and Kalshi ban insider trading on paper and have implemented policies to guard against this kind of activity. Additionally, Polymarket has
tightened the screws on VPN-based users as bans and blocks piled up in more than 30 jurisdictions, including Spain, Indonesia, France, and the United Kingdom.
There’s also the fight with states that say sports contracts on prediction markets are just unlicensed sportsbooks.
There were at least 20 ongoing cases related to this as of February of this year, and 38 states joined an amicus brief backing Maryland against Kalshi. Utah Gov. Spencer Cox called the products “gambling, pure and simple,” while the CFTC told states to get out of the way.
Prediction Markets Keep Getting Bigger Anyway
Of course, none of this has slowed down the industry’s growth. Combined monthly volume on Kalshi and both Polymarket venues rose from under $2 billion in August of last year to a peak of about $50.6 billion in July,
according to The Block. August then slipped 15% to $45.3 billion, the first monthly decline in a year after the World Cup bump faded. During the World Cup,
Kalshi alone printed $1 billion to $1.25 billion in sports volume on some days. This success enjoyed by these platforms has also led traditional sportsbooks like DraftKings and FanDuel to get involved.
Indeed, sports contracts have been a key driver of growth for the prediction markets industry, which has led to criticism that this is really just degenerate gambling by another name. Former Dallas Mavericks analytics director and legendary NBA bettor Haralabos Voulgaris summarized this point of view in his response to the news regarding LeBron James’s new deal with Polymarket. “$15m to help get a generation of kids hooked on gambling is a choice,”
Voulgaris wrote on X, and added “LeShame.”
James will reportedly be paid $15 million a year to endorse Polymarket, more than three times the amount the Philadelphia 76ers are paying him to play basketball this season.
However, prediction market proponents contend that the data on the probabilities of future events provides a separate benefit to society in the form of better signals regarding whether those events will occur. Indeed,
a Federal Reserve staff paper on Kalshi’s contracts from earlier this year found that its federal funds and CPI markets offered statistically significant improvements over fed funds futures and professional forecasters.
© Shutterstock
© Shutterstock
(Image credit: Shutterstock)
