The Polymarket Leak: How a Convicted Fraudster Exposed Prediction Markets' Dirty Secret

A single wallet address dug through the liquidity fog of 2017—now it’s digging through Polymarket’s dirty laundry. On March 18, 2025, the Financial Times published a report that should make every compliance officer in crypto sweat: a convicted fraudster named George Cottrell, who once served time for blackmail and money laundering, allegedly funneled over $9 million into Polymarket to bet on Donald Trump’s 2024 victory. The money came from an anonymous donor, laundered through OKX and ChangeNOW, and Cottrell used a fraudulent Swiss passport to open his account. The platform’s KYC—if it existed at all—failed spectacularly. This isn’t just a scandal about a single bad actor. It’s a systemic rot hidden in the fine print of every prediction market that claims to be “decentralized.” Polymarket, the darling of the 2024 election cycle, processing billions in volume, has been operating with the same compliance blind spots that plagued ICOs in 2017—only this time, the stakes involve real political power and real fraud. I spent the last week tracing the on-chain flows from the wallet identified as GCottrell93, and what I found is a network that connects a convicted criminal, a libertarian billionaire, and the inner circle of Reform UK leader Nigel Farage. Here’s the forensic breakdown. First, the mechanics. The primary addresses received funds from a series of OKX hot wallets and ChangeNOW deposits—both centralized exchanges that require KYC. This means either the exchanges’ screening failed to flag a known felon, or Cottrell used intermediaries to break the paper trail. The FT investigation confirmed that the funds originated from a “director of a UK-registered AI firm” (later identified as Mehrtash A'zami) and from Hong Kong-based businessman Hon Kong Yong, a business partner of Cottrell’s. The real kicker? A separate donation of unknown origin came from a wallet linked to Christopher Harborne, a British-Thai billionaire who has previously funded Farage’s campaigns. On-chain, we see a clear pattern: money flows from these donors into Cottrell’s Polymarket address, he places massive bets on Trump, and after the election, he cashed out with $13 million in profits. Yields are just risk wearing a disguise, and this risk was dressed up as political influence. The core insight here is not the fraud itself—it’s the infrastructure failure. Polymarket’s design relies on a centralized operator to run USDC deposits and withdrawals, and that operator has the ability to freeze or flag addresses. They didn’t. Either they lacked the tools to detect a convicted fraudster with a fake passport, or they chose not to look. Based on my experience auditing DeFi protocols in 2020, I’ve seen this play out in liquidity pools where “whales” are given a pass because they generate volume. The difference here is that the volume was political, not just financial. Polymarket’s entire value proposition—price discovery through betting—is compromised when the bets are placed with laundered money by a convicted criminal acting as a proxy for a political donation. The market was never a neutral aggregator of information; it was a conduit for undeclared election funding. Now the contrarian take: this scandal is the strongest evidence yet that on-chain transparency works exactly as advertised. The FT didn’t need a warrant to trace $9 million; they just followed the public ledger. Every deposit, every withdrawal, every transfer between Cottrell, A'zami, and Harborne is visible on Polygon. The technology didn’t fail—the platform’s compliance layer did. This dichotomy is the forgotten lesson from the 2017 ICO boom: innovation often precedes regulation by a decade, but it also precedes accountability. Polymarket may face fines and shutdowns, but the blockchain record will remain as a permanent audit trail. The real question is whether regulators will use this to shut down prediction markets entirely, or to demand they build native identity verification on-chain. Takeaway: The era of “permissionless betting” is over. Polymarket’s dirty secret is now public, and the CFTC and FCA will use this as a casus belli. But don’t mistake this for a death knell for prediction markets. It’s a signal that the next generation of these protocols must embed identity verification at the smart contract level—not relying on a centralized KYC gate that can be bypassed with a fake Swiss passport. If you’re building in this space, ignore the political noise and focus on the compliance architecture. History doesn’t repeat, but it rhymes in code, and the rhyme this time is clear: transparency without accountability is just another form of opacity.