Polymarket's compliance chief wrote a memo flagging the problems, then resigned. Now the CFTC wants the records.

In February, attackers started linking stolen debit cards to Polymarket US accounts, placing bets, and trying to pull the money out to clean accounts and cards they controlled. The target was at least $10 million. One account made about 4,000 deposit attempts on its own. It got so bad that Checkout.com, Polymarket's payment processor, began rejecting deposits itself. At the peak it was flagging more than 80% of Polymarket's deposits as fraudulent.

The reporting says the bigger problem was inside the company. Polymarket is accused of putting user growth ahead of compliance safeguards while the attack was live, and the departures back that up. US Chief Compliance Officer Andrew Clifford resigned in April after submitting a formal memo on compliance deficiencies. Justin Hertzberg, CEO of Polymarket US, was fired. The heads of US regulation and anti-money laundering left too. The CFTC has opened an investigation and told employees to preserve records.

The card attack wasn't a one-off. In June, hackers got in through a third-party vendor and injected malicious code into the site, hitting some user balances directly. In July, a registration flaw let attackers with stolen personal data take over nearly 500 existing accounts without passwords. Polymarket reimbursed those users.

Shayne Coplan also sits on the CFTC's Innovation Advisory Committee, one of 35 members. The agency now investigating his company counts him as an advisor on how to regulate innovation.

Polymarket has spent two years arguing it deserves to be treated as serious financial infrastructure, a regulated venue where people price real-world events. An exchange acts on its compliance chief's memo. Polymarket's compliance chief wrote one and then walked. When your payment processor is rejecting 80% of your deposits before you do, Checkout.com is running your fraud controls.

Polymarket odds get quoted everywhere now, including on this sub, as if they're a neutral reference price for elections, wars, and Fed decisions. A platform in that position doesn't get to treat "move fast" as a culture quirk. If the CFTC finds leadership overrode its own compliance people during a live fraud attack, the cost won't stop at a fine. Every state regulator trying to ban prediction markets will be handed the exact evidence they've been asking for.