Password-Free Fraud Hits Prediction Market

In late July, approximately 500 Polymarket users in the US were targeted in a sophisticated fraud attack that did not require passwords, usernames, or compromised phone numbers. The exploit allowed perpetrators to access existing user accounts using stolen personal information, gaining access to linked financial accounts and leading to reported losses for users.

Users described significant financial damages, with one individual reporting a loss of over $5,700 from his account. These users faced weeks of delayed or non-existent support from Polymarket. The platform's handling of fraud has come under increased scrutiny, with past warnings from payment processors about thieves exploiting stolen debit cards to fund wagers.

Reports suggest that company leadership viewed fraud as an acceptable cost for expansion. This approach persisted for months, with high fraud rates noted even after February. By May, measures like debit card limitations and antifraud contractors were implemented, bringing fraud rates back to industry norms.

This incident follows other security breaches, including a compromised third-party vendor injecting malicious scripts, resulting in millions drained from user funds. The company has committed to refunding affected users for these separate incidents.

Beyond direct fraud, prediction market platforms like Polymarket and Kalshi also face issues with insider trading allegations, involving individuals using non-public information for financial gain. Regulatory challenges also persist, with states challenging the nature of prediction market contracts as unlicensed sportsbooks.

Despite these challenges, the industry has seen substantial growth in combined monthly volume. Traditional sportsbooks are also entering the prediction market space, fueled by the success of sports contracts, though critics argue this represents a move towards increased gambling.