Is Polymarket Safe in 2026? Regulation, Custody and the Real Risks

Polymarket US, the app US residents can use, is a CFTC-regulated exchange with its own clearinghouse, and it keeps customer money in an account separate from its operating funds. By the usual tests for a US trading venue, it is safe. The risks that remain are specific: a state can switch off access where you live, a stolen login can empty your account, and a market can resolve in a way you did not expect.

Most older articles about Polymarket safety describe the international polymarket.com site, which settles trades on the Polygon blockchain. That site has different risks, and US residents cannot open new positions on it. This guide covers both and says which is which.

Quick answers

• Is Polymarket legal in the US? Yes, through Polymarket US, except in states that have blocked it. As of August 2026 that was Arizona, Illinois, Massachusetts, Maryland, Michigan, Montana, Nevada and Ohio.
• Who regulates it? The CFTC. Polymarket US runs on QCX LLC, a designated contract market, and QC Clearing LLC, a clearinghouse.
• Is my money held separately? Polymarket US says customer funds sit in a dedicated account that the company cannot use.
• Has Polymarket been hacked? Some international-site accounts were drained in December 2025 through a flaw at a third-party login provider. We know of no breach of the US app.
• Is it gambling? Federally it is a regulated derivatives market. Several states argue sports contracts are gambling, and a Nevada judge agreed in a preliminary ruling.
• Is it safer than Kalshi? The two now have a similar structure. Both are CFTC-regulated exchanges holding dollars.

Four kinds of risk

"Safe" covers four separate questions, and Polymarket scores differently on each.

1. Legal. Can you use it where you live, and is the venue authorized?
2. Financial. Where does your money sit, and what happens if the company fails?
3. Market integrity. Are outcomes decided fairly, and can a large trader move a market?
4. Account and user error. What happens if someone steals your login, or you send money the wrong way?

Legal status

Polymarket left the US in 2022. That January the CFTC fined it $1.4 million for running an unregistered venue for event contracts, and Polymarket then blocked US users (The Block).

It came back by buying a licensed exchange. In July 2025 Polymarket bought QCX LLC and QC Clearing LLC for $112 million. The CFTC signed an Amended Order of Designation on November 24, 2025, announced the next day, which allows Polymarket to run an intermediated US trading platform (Covers). The US app opened to a waitlist on December 3, 2025, and to all eligible iPhone users on May 12, 2026.

That puts Polymarket US under the same federal rules as Kalshi: the Commodity Exchange Act, CFTC oversight of new contracts, market surveillance and customer-fund protections.

The states are another matter. Several argue that federal approval does not override their gambling laws for sports contracts.

• Nevada. The Gaming Control Board sued on January 15, 2026. A judge granted a temporary restraining order on January 29, ruling that the Commodity Exchange Act does not give the CFTC exclusive authority over Polymarket's contracts. Polymarket US withdrew from the state (SBC Americas).
• Tennessee. The Sports Wagering Council sent cease-and-desist letters to Polymarket, Kalshi and Crypto.com on January 9, 2026, over sports contracts (Covers).
• Blocked states. As of an August 18, 2026 check, Polymarket US was not available in Arizona, Illinois, Massachusetts, Maryland, Michigan, Montana, Nevada or Ohio (OddsShopper). Some trackers disagree on a few of these while court cases continue.
• Minnesota. A federal court blocked enforcement of a state felony law aimed at prediction markets on July 27, 2026, before it took effect (OddsShopper, above).

The practical risk is not that you break a law by using the app where it is offered. The app checks your location. The risk is that a ruling closes your state while you hold positions. Read our prediction-market legality guide for the wider dispute and our guide to using Polymarket in the US for the sign-up steps.

The international site lists the United States as close-only on both its website and its API (Polymarket docs, as of October 2026). Using a VPN to trade there breaks its terms and risks the account.

Where your money sits

On Polymarket US, your balance is in US dollars. Polymarket US says customer funds are "kept in a dedicated customer account that is separate from Polymarket US's operating funds" and that the company cannot access or use them (Polymarket US docs). Settlement runs through Polymarket Clearing, the CFTC-registered clearinghouse. That is the standard structure for a US futures exchange. It is not FDIC or SIPC insurance, and no prediction-market account has that.

On the international site, your balance is pUSD, a token on the Polygon blockchain backed one-for-one by USDC and enforced by smart contracts (Polymarket docs). You can check balances and trades on a public block explorer. That transparency is real. The protection behind it is different: there is no US regulator and no segregation rule, and the risks are code and stablecoin risk.

Account security

Most money lost on prediction markets is lost through stolen logins, not exchange failures.

In December 2025 Polymarket said "a vulnerability introduced by a third-party authentication provider" let attackers drain a small number of international-site accounts. It did not say how many or how much (The Block). Users reported similar drains in late 2024 after signing in with Google.

Polymarket US accounts are opened with a Google or Apple login, so the security of that account is the security of your Polymarket balance. Polymarket US warns that if you lose your credentials or someone else gets them, you can lose access to your funds. Turn on two-factor authentication for the Google or Apple account you use, and never share a code sent to you.

One rule limits the damage on the US app. Withdrawals can only go back to the payment method you deposited with, so a thief cannot simply send your balance to a new bank account (withdrawal rules). They can still place trades.

Smart-contract risk

This applies to the international site, where trades settle through smart contracts on Polygon. A bug in that code could let an attacker take funds held in the contracts, and there would be no insurance.

Polymarket publishes its contract addresses and audit reports. Its 2026 contract upgrade was audited by Cantina, Quantstamp, SigmaPrime and Certora between May and August 2026 (Polymarket contracts and audits). Audits lower the risk. They do not remove it.

Polymarket US users hold dollars at a regulated clearinghouse and do not carry this risk directly.

Stablecoin risk

Also an international-site risk. pUSD is backed by USDC, a dollar stablecoin issued by Circle and backed by cash and short-term US Treasuries. USDC has broken its peg once. In March 2023 Circle disclosed $3.3 billion of reserves at Silicon Valley Bank when the bank failed, and USDC fell as low as about $0.87 before recovering within days once US regulators guaranteed SVB deposits.

A repeat would cut the dollar value of an international-site balance until the peg came back. Polymarket US balances are held in dollars and are not exposed to this.

How outcomes are decided

Every market has written rules naming its resolution source. The title is a summary. The rules decide.

Polymarket US. The exchange decides the outcome once it is public, using only the sources named in the rules: government data, league results, named price indexes or named news outlets. Polymarket Clearing settles the contracts, and resolutions are final under the exchange rulebook (Polymarket US docs). A few markets carry special settlement terms, such as a 50-50 split if a game is canceled with no make-up date. These appear in the market rules.

International site. Markets resolve through UMA's optimistic oracle. Anyone can propose an outcome by posting a bond, typically $750. If no one disputes it within two hours, it stands. If it is disputed twice, UMA token holders vote (Polymarket docs). The process is open and has a record of going wrong. In March 2025 a market asking whether Ukraine would agree a minerals deal with the US before April resolved Yes, although no deal had been agreed. Polymarket called it an unprecedented governance attack by a large UMA holder and did not refund traders (The Block).

On either product, the defense is the same. Read the rules and the named source before you trade. If you cannot say exactly what would make the market resolve Yes, do not trade it.

Manipulation and insider trading

Thin markets can be pushed around. A five-figure order can move the price of a market with little resting size, and a moved price says little about real odds. Treat prices in small markets as rough. Check the order book depth before you trust a number or trade size.

Polymarket US publishes a market integrity policy. It bars trading on confidential information obtained in breach of a duty, trading by anyone in a position to affect the outcome, and, in some sports markets, trading by players, coaches, staff and their families (trading restrictions). As a CFTC-regulated exchange it must also run market surveillance.

Withdrawals

Withdrawal delays are the most common complaint about any trading app, and on Polymarket US most of them follow from three published rules:

• Deposits must clear first. Debit card and ACH deposits take 3–4 business days to clear. You can trade with "instant buying power" before then, but you cannot withdraw that money, or profits made with it, until the deposit clears (Polymarket US help center).
• Money goes back where it came from. Withdrawals must return to the original funding method. Wires out are handled by support, not the app.
• First in, first out. Withdrawals are processed in the order deposits were made, and every withdrawal passes anti-money-laundering checks.

Promotional credits can never be withdrawn. Withdrawals themselves are free. If a deposit is still pending after five business days, Polymarket US asks you to contact support.

Is Polymarket gambling?

Under federal law, no. The CFTC regulates Polymarket US's contracts as derivatives, the same category as CME futures and Kalshi's event contracts. A contract pays $1 if an event happens and nothing if it does not. You trade it with other users, you can sell before the end, and the exchange does not take the other side.

Several states see it differently for sports. Nevada's regulator argues the contracts "are wagers," and a Nevada judge found that argument likely to succeed. Tennessee, Massachusetts and others are making similar cases. For non-sports markets such as elections, economics and weather, states have pushed back less.

The experience of buying a sports contract is close to placing a bet, and it carries the same risk of losing your stake. If trading stops feeling like a choice, the responsible trading page lists help, including 1-800-GAMBLER. Our guide Is Kalshi gambling? covers the legal argument in more depth.

Is Polymarket haram?

Polymarket has no Sharia certification and does not offer a Sharia-compliant product. Two concepts from Islamic finance apply:

• Maysir means gambling, or gain from chance. Many scholars class prediction-market trading as maysir because the result depends on a future event the trader does not control.
• Gharar means excessive uncertainty. Scholars disagree on where acceptable commercial risk ends. Many apply a strict reading to prediction markets because the contract has no underlying productive asset.

A minority view treats prediction markets as forecasting tools, closer to hedging with commodity futures, when used to inform decisions rather than for entertainment. That view is not widely held. If this matters to you, ask a scholar you trust. Bellwether cannot give that ruling.

How to use Polymarket safely

1. Start small. Deposit $20 to $100, make a few trades, and withdraw some money once the deposit clears. Confirm the whole cycle works before you add more.
2. Lock down your login. Turn on two-factor authentication for the Google or Apple account you sign in with. Never share a code sent to you.
3. Read the rules on every market. Check the named resolution source and any special settlement terms.
4. Check your state before you deposit. Let the app's location check run first, and follow news on court cases in your state.
5. Use money you can afford to lose. Any position can go to zero.
6. Check the order book. In thin markets the spread can cost more than the fee. Use limit orders.
7. Keep records. Export your trade history each year. Event-contract gains are taxable and the tax treatment is unsettled; see our guide to event-contract taxes and talk to a tax professional if your volume is large.

Compared with offshore sportsbooks

Offshore sportsbooks that take US customers usually have no US regulator, no published rulebook and no segregation of customer money. If one delays or refuses a withdrawal, you have little recourse. Polymarket US is a CFTC-regulated exchange with segregated customer funds, a US clearinghouse and a published rulebook. On safety, that is a large difference.

Compared with Kalshi and Robinhood

Polymarket US and Kalshi now have the same basic structure: a CFTC-designated exchange, dollar balances, bank and card funding, and identity checks. Neither runs on a blockchain for US users. The differences are practical. Kalshi has far more volume, its own state fights, and pays interest on cash balances. Polymarket US is blocked in more states and holds less volume.

Robinhood Event Contracts trade inside a Robinhood account and route to exchanges including KalshiEX. Your cash sits at Robinhood, a broker most users already know. For safety, the main question is which company you would rather trust with your login and balance. See Kalshi vs Polymarket for the full comparison.

Open a Polymarket account →

FAQ

Is Polymarket legal in my state?

It depends on the state. As of August 2026 Polymarket US was not available in Arizona, Illinois, Massachusetts, Maryland, Michigan, Montana, Nevada or Ohio. Elsewhere it is offered under its CFTC approval. The app checks your location before you trade.

Is my money insured?

Not by the FDIC or SIPC. Polymarket US says it holds customer funds in a dedicated customer account, separate from company money. Segregation of this kind is the standard protection at US futures exchanges.

Has Polymarket ever been hacked?

In December 2025 a flaw at a third-party login provider let attackers drain a small number of accounts on the international site. Polymarket did not disclose the total. We know of no breach of Polymarket US.

Can I lose more than I put in?

No. The most you can lose on a contract is what you paid for it, plus fees.

What happens if a market's wording is unclear?

On Polymarket US the exchange applies the sources named in the rules, and its decision is final under the rulebook. On the international site, disputes go through UMA's oracle and can end in a token-holder vote.

Are Polymarket winnings taxable?

Yes. How event-contract gains are taxed is not settled, so keep records and ask a tax professional. Our tax guide covers the open questions.

Should I use a VPN to reach polymarket.com?

No. It breaks Polymarket's terms, and accounts that get around location blocks can be closed with funds frozen.

Is Polymarket safer than Kalshi?

Neither is clearly safer. Both are CFTC-regulated exchanges holding customer dollars in segregated accounts. Kalshi's larger volume and longer US record count in its favor; Polymarket US's withdrawal-to-source rule limits what a thief can do.