Polymarket, the largest prediction market by volume, faces simultaneous regulatory and compliance failures across three fronts: a CFTC fraud investigation triggered by a $10 million stolen-card attack, cease-and-desist orders from Missouri targeting six prediction market operators, and internal l...
"Companies cannot simply repackage sports bets as event contracts to sidestep that framework." — Catherine Hanaway, Missouri Attorney General
Polymarket, the largest prediction market by volume, faces simultaneous regulatory and compliance failures across three fronts: a CFTC fraud investigation triggered by a $10 million stolen-card attack, cease-and-desist orders from Missouri targeting six prediction market operators, and internal leadership upheaval that has cost the company its chief compliance officer, U.S. CEO, and heads of anti-money laundering. The crises arrive as prediction market monthly trading volume has scaled from $1.2 billion in early 2025 to $44.8 billion in June 2026 — a 37x increase that has outpaced the compliance infrastructure meant to govern it.
Polymarket is currently raising approximately $1 billion at a $21 billion valuation, according to reporting by the Wall Street Journal. That fundraise now proceeds under a cloud: the CFTC has instructed employees to preserve records, the platform's payment processor rejected over 80% of U.S. deposits as fraudulent at peak, and a July 2026 security flaw compromised roughly 500 user accounts. The question facing the sector is whether prediction markets can sustain institutional-grade growth rates on startup-grade compliance.
Beginning in February 2026, fraudsters linked stolen debit cards to thousands of new accounts on Polymarket's U.S. platform, depositing funds, placing bets, and attempting to withdraw winnings to cards or accounts they controlled. The total attempted theft exceeded $10 million, according to the Wall Street Journal.
The scale of the attack was visible in payment processing data. Checkout.com, Polymarket's payment processor, rejected more than 80% of incoming U.S. deposits as fraudulent during the peak of the attack. Industry-standard fraud rejection rates sit at roughly 1%. One user alone attempted approximately 4,000 separate deposits; about seven users drove the bulk of fraudulent activity.
Polymarket contained the attack by May 2026 after implementing deposit caps per debit card. Fraud rates returned to industry norms. But by then, the damage had been compounded by a separate security incident: a July 2026 registration flaw that allowed account takeovers using only a victim's Social Security number, compromising approximately 500 accounts. Polymarket agreed to cover those losses.
The fraud attack exposed structural compliance failures inside Polymarket's U.S. operation. According to the Wall Street Journal, CEO Shayne Coplan told employees to prioritize growth and address any regulatory fines later when compliance staff raised concerns about the stolen-card attack.
More critically, Polymarket removed a standard anti-money laundering safeguard during the attack: the requirement that funds be withdrawn through the same payment method used for deposits. The policy was scrapped to clear a withdrawal backlog created by the fraud, but employees warned internally that the change invited money laundering. This control — matching deposit and withdrawal methods — is standard practice across regulated financial institutions.
The compliance fallout was swift. Andrew Clifford, the chief compliance officer, resigned in April 2026 after submitting a detailed internal fraud report. Justin Hertzberg, the U.S. CEO, was fired. The heads of U.S. regulation and anti-money laundering also departed.
Polymarket hired Warren Jenson, a former Amazon finance chief, as its first CFO. An internal review conducted by law firm Sullivan & Cromwell concluded that Polymarket complied with applicable regulations, according to the company.
The leadership churn represents a pattern. Polymarket acquired QCEX, a CFTC-licensed exchange and clearinghouse, for $112 million in July 2025 to establish its regulatory footing in the U.S. market. Less than a year later, key compliance personnel from that operation had departed.
The Commodity Futures Trading Commission has opened an investigation into Polymarket, instructing staff to preserve records tied to the fraud attack and other matters. The specifics of the investigation have not been publicly disclosed beyond the preservation directive.
This is not Polymarket's first encounter with CFTC enforcement. In January 2022, the CFTC fined Polymarket (then operating as Blockratize) $1.4 million for operating an unregistered swaps facility and non-designated contract market. The settlement forced Polymarket to wind down non-compliant U.S. markets.
The current investigation arrives amid broader CFTC moves to assert jurisdiction over the prediction market sector. Between July and August 2026, the CFTC issued five letters or emergency orders directed at prediction market operators, grounding its authority in the Dodd-Frank Wall Street Reform and Consumer Protection Act. In March 2026, the CFTC published an advisory on prediction markets; a June 2026 proposed rule followed.
The jurisdictional question matters because CFTC regulation under Dodd-Frank potentially preempts state gambling laws — a shield prediction market operators need as state attorneys general begin treating event contracts as unlicensed betting. However, CFTC oversight also carries enforcement teeth: Dodd-Frank's anti-fraud and anti-manipulation provisions give the agency authority over prediction market operators that is functionally equivalent to what the SEC exercises over securities exchanges.
The CFTC is also conducting an internal review of "mention markets" — contracts where traders speculate on whether specific words will appear in speeches, earnings calls, or broadcasts — raising questions about the boundaries of permissible event contracts.
On September 18, 2026, Missouri Attorney General Catherine Hanaway issued cease-and-desist letters to six prediction market companies: Polymarket, Kalshi, Crypto.com, Novig, Underdog, and Robinhood. Each company was given 30 days to comply.
Hanaway's legal theory is that sports-linked event contracts constitute unlicensed sports betting under Missouri law. Missouri launched its licensed sports betting market on December 1, 2025, under Amendment 2 (approved by voters in 2024). Licensed operators pay a 10% tax on gross sports betting receipts and must implement age verification preventing access by users under 21.
The AG's office found that five of the six companies lacked adequate safeguards to prevent minors from accessing their platforms. Hanaway rejected the industry's federal preemption argument, contending that prediction market contracts do not qualify as commodity swaps and that federal law does not override Missouri's regulatory authority.
Missouri is not acting alone. More than a dozen states are probing whether Polymarket and its rivals are operating unlicensed gambling platforms. New York City is separately investigating Polymarket's advertising practices.
The federal-state jurisdictional conflict is unresolved. If the CFTC's Dodd-Frank authority holds, event contracts may be classified as regulated financial products exempt from state gambling oversight. If it does not, prediction market operators face a 50-state compliance patchwork that could significantly constrain their U.S. operations.
The compliance and regulatory crises unfold against a backdrop of sustained growth in prediction market volumes:
Monthly trading volume trajectory:
The sector's unique user base more than tripled to 840,000 in the six months through February 2026, according to TRM Labs.
Polymarket U.S. open interest stood at $111.4 million as of late August 2026, nearly doubling since the World Cup ended in mid-July. The U.S.-regulated platform now accounts for 54% of total Polymarket volume. Polymarket U.S. runs entirely on fiat U.S. dollar contracts with full KYC compliance — no crypto collateral, no anonymous wallets.
Volume composition by category (September 2026): Sports $2.39 billion (28%), Politics/Government $496.7 million (5.8%), Finance/Fed $147.1 million (1.7%), Entertainment $8.6 million (0.1%), Other $5.52 billion (64.4%).
By comparison, Kalshi's open interest fell from approximately $2 billion to $1.5 billion post-World Cup. Kalshi spent $500,000 lobbying federal policymakers on prediction market regulation in Q2 2026, more than any prior quarter.
The two dominant U.S. prediction market operators have taken divergent paths to regulatory compliance:
Kalshi operates as a CFTC Designated Contract Market (DCM) — the same regulatory category as the CME Group. It uses fiat U.S. dollars exclusively, mandates full KYC, and has historically focused on macroeconomic data, government policy outcomes, and officially sanctioned events. Kalshi closed a $185 million funding round in mid-2025.
Polymarket spent its formative years as a crypto-native platform before acquiring CFTC-licensed QCEX for $112 million in July 2025 to establish a regulated U.S. presence. Its international platform continues to operate on crypto rails (USDC on Polygon), while its U.S. platform runs on fiat. Polymarket is raising approximately $1 billion at a $21 billion valuation, with 1789 Capital (affiliated with Donald Trump Jr.) contributing roughly $300 million.
The structural difference matters. Kalshi's compliance infrastructure was built from inception around CFTC requirements. Polymarket's U.S. compliance apparatus was grafted onto a crypto-native platform via acquisition — and the departures of its CCO, U.S. CEO, and AML leads suggest the integration has not been seamless.
The combined monthly volume of $44.8 billion in June 2026 positions prediction markets as a non-trivial segment of the broader derivatives market. Wall Street projections cited by Crypto-Reporter suggest the sector could target $1 trillion in annual volume, though that figure assumes resolution of the current regulatory uncertainty.
Prediction markets grew from a niche crypto experiment to a $44.8 billion-per-month industry in roughly 18 months. Polymarket sits at the center of that expansion — and at the center of the compliance failures that accompanied it.
The platform's trajectory mirrors a pattern common in rapidly scaled financial services: growth-stage velocity colliding with regulatory-grade compliance requirements. The $1.4 million CFTC fine in 2022 was a warning. The $112 million QCEX acquisition in 2025 was an attempted fix. The departure of compliance leadership in 2026, followed by a CFTC investigation, state-level crackdowns, and a WSJ expose, suggests the fix was insufficient.
The resolution of the CFTC's Dodd-Frank jurisdictional claim will determine the industry's structure. If the federal framework holds, prediction markets gain a single-regulator model that preempts state gambling law — but also subjects operators to derivatives-market enforcement standards. If it does not, the sector faces a fragmented compliance landscape that may be economically unviable for all but the most capitalized operators.
Polymarket's ability to close its $1 billion raise at a $21 billion valuation while under active CFTC investigation will serve as a market test of investor confidence in the sector's regulatory trajectory. The outcome will likely shape capital allocation across the prediction market industry for the next 12 to 24 months.