Hook
The number that should stop you is not the dollar figure. It is eighty percent.
According to reporting by The Wall Street Journal, Checkout.com โ the payment processor handling Polymarket's US deposits โ flagged more than eighty percent of the transactions it touched as fraudulent during a stretch of 2025. The industry baseline for such rejection rates sits near one percent. A deviation of that magnitude is not a spike. It is a structural failure wearing the costume of a traffic problem. More than $10 million in attempted stolen-card deposits moved through a platform that had, by then, already loosened a core anti-money-laundering control โ and had done so without telling anyone.
Context
Polymarket is the largest prediction market in the world by liquidity and event depth. It spent years outside the US regulatory perimeter, settled with the CFTC in 2022, and returned to American shores in late 2025 in a beta capacity. Kalshi holds the cleaner compliance path, operating under a CFTC-regulated exchange license. CME sits further upstream โ institutional, heavily supervised, slow by design.
That return to the United States coincided with a capital narrative of unusual scale: roughly $1 billion raised at a reported $21 billion valuation. Some circulating versions of the story put the figure at $210 billion, a tenfold discrepancy that I will flag rather than repeat. A first-ever CFO was hired, drawn from a major e-commerce balance sheet. A 2027 IPO entered the conversation.
This is the backdrop against which the compliance questions land โ not a struggling startup cutting corners to survive, but a category leader raising at scale while its guardrails were being removed.
Core
Here is what my audit training tells me to look at: not what a company says, but where the controls actually sit โ and where they were taken out.
I spent 2017 reading token sale documents line by line for distribution vulnerabilities in the EOS and Golem offerings. The lesson from that period carried into every review I have done since: risk rarely announces itself as a single catastrophic flaw. It shows up as a chain of individually survivable weaknesses, each one tolerated because the next link was assumed to hold.
Polymarket's chain had three links. All three gave way.
The first was the payment layer. A rejection rate above eighty percent means the US deposit rail was close to half-paralyzed. Fraud screening was operating reactively โ after money had already been submitted โ rather than stopping abuse at the front door. Legitimate users almost certainly paid for it too; reporting points to a backlog of genuine withdrawal requests during the same window.
The second was a rule that was deliberately removed. Management eliminated the same-channel withdrawal requirement, the control that money must return to the payment source it came from. It is not legally mandated in every jurisdiction, but it is standard practice across regulated financial institutions precisely because it is the cheapest and most effective barrier against moving dirty funds. Removing it is the technical equivalent of lifting a floodgate and calling it a plumbing optimization.
The third was identity. In late July, attackers took over roughly 500 accounts, along with their linked bank accounts and cards, using nothing but a victim's Social Security number. No password. A single identifier โ the trust anchor for the entire US account system โ was sufficient to seize control. That is not a sophisticated exploit. That is an authentication design that never should have shipped.
The remedy proposed was to cap the number of debit cards a single user can link. Months of fraud pressure, answered with a rule tweak rather than an architectural rebuild. That tells you something in itself.
One more data point deserves weight. The fraudulent activity was concentrated: roughly seven users accounted for the bulk of it, with one individual attempting around 4,000 deposits. Seven accounts. Four thousand attempts. A risk threshold loose enough to permit that is not a threshold. It is a suggestion.
Layer this against the human record. The chief compliance officer filed a fraud report in April โ and then resigned. The US CEO was dismissed. The US regulatory lead left. The AML lead left. An internal review conducted by Sullivan & Cromwell concluded the company had complied with regulations โ an audit commissioned by the company itself. Trust is the only currency that matters, and it is not something a firm can invoice to its own counsel.
Meanwhile the CFTC opened a formal investigation and instructed staff to preserve records. Noise filtered. Signal preserved.
Contrarian
The instinct right now is to treat this as a regulatory-headline problem โ a fine to be paid, a bump before the IPO. That framing is comfortable, and I think it is wrong.
The real exposure is not the penalty. It is the payment rail. Polymarket's American operation depends on a single upstream processor. When that processor begins rejecting four out of five transactions, the company has effectively outsourced part of its license to operate to a vendor with no obligation to keep it. A CFTC fine is quantifiable and survivable. Loss of the deposit channel is neither.
There is a second, quieter paradox. The same disclosure gap that produced the $21 billion versus $210 billion confusion is itself a signal. If the market cannot agree on the order of magnitude of a private company's valuation, then the information feeding its narrative is unreliable at the most basic level. The internal review says one thing; the CFTC's record-preservation order says another. Only one of those carries subpoena power.
Takeaway
The next phase of prediction markets will not be decided by who has the deepest liquidity. It will be decided by who can persuade a bank, a card network, and a regulator to keep the lights on. Polymarket built the best product in the category and staffed the weakest version of the infrastructure that product needs to survive in the United States.
The question worth asking is not whether the fine arrives. It is whether, when the capital narrative and the compliance reality finally meet, the industry reads the gap correctly โ or prices it as noise.
Truth over hype. Always.