Checkout.com flagged more than 80% of Polymarket's U.S. deposits as fraudulent. The industry baseline is roughly 1%.
A payment processor does not arrive at 80% through statistical noise. It arrives there when a merchant's onboarding layer has stopped filtering and the processor becomes the only defender left standing at the door. Between February and May, seven accounts — one of them attempting roughly 4,000 deposits — pushed a stolen-card operation past $10 million in attempted volume. Silence before the gas spike reveals the trap. Here the silence was at the risk desk, and the trap closed on the payment channel.
The chain is not implicated in any of this. Every settlement executed exactly as written. What failed was the layer bolted on top of it: a payments-and-identity stack that a prediction market treats as plumbing and an attacker treats as the product.
Polymarket is the largest crypto-native prediction market, a platform where users buy and sell contracts on event outcomes, with prices functioning as crowd-sourced probability. It has no native token. It settled with the CFTC once before, rebuilt, and spent years operating outside the U.S. before a limited American beta late last year. The company is now on an equity path, not a token path: it has hired its first chief financial officer, Warren Jenson, a former Amazon finance executive, and has discussed a 2027 listing. A financing round of roughly $1 billion is reportedly in motion at a valuation near $21 billion, with 1789 Capital — the vehicle tied to Donald Trump Jr. — said to be adding about $300 million on top of an earlier $200 million. One circulating version of that valuation is ten times smaller. I will not resolve the discrepancy here; I will only note that in a bear market a ten-fold gap in reported numbers is not a footnote, it is the temperature of the story.
The competitive frame matters too. Kalshi holds a CFTC license and a cleaner regulatory posture. CME brings institutional weight. Whether Washington picks a winner among prediction markets is now a live question, and Polymarket's compliance record is the material that question will be argued with.
The teardown that follows is not about whether prediction markets deserve to exist. It is about three gates that stood between stolen money and exit — and what happened to each.
Gate one was the payment layer, and it failed by design. In 2017 I spent my spare evenings pulling transaction failure rates off Etherscan, and roughly 40% of failed transactions traced back to contracts that estimated gas for the happy path — no congestion, no competing bids, no adversary. Risk control bolted on after the transaction had already been broadcast. Checkout.com's 80% fraud rejection rate describes the same architecture of optimism. Detection did not happen at onboarding. It happened downstream, at the processor, after the card was already in play. Legitimate withdrawals backed up while the filter caught up. That is the invoice for post-hoc risk control, and real users paid it.
Gate two was deleted. The rule required that funds return through the same channel they arrived on — same card, same bank, same path. It is not statute. It is standard practice, and it is the mechanism that prevents stolen money from walking out through a different door than it walked in. Management removed it. The sequence that followed is documented: Chief Compliance Officer Andrew Clifford filed a fraud report, then resigned. U.S. CEO Justin Hertzberg was dismissed. The head of U.S. regulation left. The AML lead left. Behind every exploit is a pattern of neglect — and here the neglect has timestamps, not adjectives. A rule does not delete itself.
Gate three was identity, and it was held together by a single number. In late July, attackers took over roughly 500 accounts using nothing but a Social Security number. No password. Along with those accounts came linked bank accounts and cards. You are not the user; you are the data. The platform had anchored its trust in an external identifier it does not control, cannot rotate, and cannot revoke — a credential that, once leaked, is permanently valid everywhere.
The remediation was a cap on how many debit cards a single user can bind. That is a rule tightened, not an architecture rebuilt. A cap explains batch binding. It does not explain why a card can be bound at all without a second factor.
Layered on top of the operational failures is a governance failure. An internal review by Sullivan & Cromwell concluded the company complied with regulations — an audit commissioned by the audited. The CEO's reported direction was to prioritize growth and address penalties later. The CFTC has since asked staff to preserve records, which is the language of evidence collection, not inquiry.
Here is what the bulls get right, and it is not nothing. The absence of a token means there is no supply overhang and no tokenholder exit to front-run bad news — a discipline most projects in this sector have never accepted. The product-market fit is real; prediction markets found liquidity that was not supposed to exist. The 80% figure is, in one reading, evidence that detection worked somewhere in the stack. Removing same-channel withdrawal is arguably defensible for crypto-native users whose funds never originated on a card. Kalshi's compliance moat is expensive and slow to build, and that cost is a genuine barrier.
But a plumbing problem left unfixed is worse than a hard technical one, because it is fixable. Hype burns out, but the ledger remains cold. Without a token, there is also no on-chain governance mechanism to force the repair — only a board, a CFO, and a regulator. And if the round prices near $21 billion, that valuation must normalize an 80% fraud rejection rate. Someone will have to sign that number.
The accountability question is not whether Polymarket survives. It is whether the gate gets rebuilt or repainted. Watch four things: whether the CFTC's record preservation becomes a Wells notice or a settlement; whether a named CCO and AML lead appear in the seat that sat empty through the worst of it; whether the card cap holds fraud under 5% for two consecutive quarters; and whether the financing closes with disclosed terms. The ledger will record all of it. It always does.
