Nearly 500 Polymarket US users were hit in late July by a fraud attack that did not require a password, a username, or a compromised phone, according to a Wall Street Journal report published September 20. The attackers exploited a bug to access existing accounts.

A passwordless account takeover at this scale threatens user trust in prediction-market custody models and could draw regulatory scrutiny of Polymarket's authentication infrastructure just as it scales US operations under CFTC oversight.