Polygon Hard Fork Aims to Recover $70.49M in Stolen POL

Polygon Governance Forum Proposes Coordinated Hard Fork to Zero Out Attacker Funds

A proposal has emerged on the Polygon governance forum suggesting a coordinated hard fork to zero out approximately 70.49 million POL tokens held in five attacker addresses. The plan also includes depositing an equivalent amount of tokens into recovery wallets designated by Binance and Polymarket.

Background: Third-Party Breach at Polymarket and Binance Hack

This proposal follows a third-party breach at Polymarket and a significant hack of the cryptocurrency exchange Binance. Polymarket confirmed a third-party vendor was compromised, leading to the incident, and has since implemented fixes, engaged law enforcement, and pledged compensation. Binance also experienced a hack, prompting immediate actions including freezing funds and a coordinated effort to track stolen assets.

Proposal Details: Zeroing Out Attacker Balances

The proposal, jointly submitted by Polymarket and Binance, aims to upgrade the asset recovery efforts from on-chain blocking to the consensus layer. It outlines a plan to execute a one-time, coordinated hard fork. This fork would directly set the balances of the five identified attacker addresses to zero, totaling roughly 70.49 million POL. Subsequently, an equivalent amount of tokens would be credited to recovery wallets specified by Binance and Polymarket.

The proposal document states that the frozen balances remain on-chain but are currently inaccessible. Polygon PoS block producers had previously added the relevant addresses to Bor’s transaction blocklist, preventing the transfer of stolen funds.

At the time of the proposal’s writing, with POL priced at $0.0924, the affected tokens were valued at approximately $6.5 million. Based on the current POL price of around $0.097, this value rises to approximately $6.85 million.

The proposal emphasizes that the hard fork would only affect native POL and would not alter the total supply of the token across the chain.

Incident Breakdown: Polymarket and Binance Breaches

The two incidents, occurring almost simultaneously, involved different attack vectors. Approximately 28 million POL on Polygon PoS are linked to the Polymarket incident. On-chain records show two native transfers on October 29th, at 18:30:34 and 18:35:39 (UTC), where over 3.28 million POL moved from an address starting with 0xe4C4 to an address starting with 0x3f70.

Following these transactions, validators’ chosen block producers blacklisted four addresses, freezing about 24 million POL. Polymarket’s post-incident report attributed the issue to a breach of a third-party supplier.

The Binance hack involved a larger sum. Binance was compromised late on October 29th. The following day, validators’ chosen block producers were requested to blacklist an address starting with 0x5227. On-chain records from block 96,406,484 indicate that a Binance hot wallet transferred 46,626,589.6 POL and 6,185,900.1 USDT to this address.

Tether has since frozen the USDT, making the remaining native POL a primary focus for recovery. Binance later requested the blacklisting of additional addresses, which are categorized as Class B in the proposal.

Address Classification and Fund Recovery

The proposal divides the addresses to be zeroed out into two groups. Four addresses associated with the Polymarket incident collectively hold 23,862,736.07 POL. The largest portion, 15,331,308.29 POL, originates from the address starting with 0xe4C4, which was also the source of the over 3.28 million POL transfer. The remaining funds are held in addresses starting with 0x5392 (4,295,442 POL), 0xc91e (4,235,982.73 POL), and the address starting with 0x3f70 (a residual 3.05 POL).

A single address, starting with 0x5227, linked to the Binance incident, received 46,626,589.6 POL before being blacklisted, representing the largest single portion of the stolen funds.

Notably, the proposal references “floor values” to prevent the inclusion of sporadic deposits during the period. The baseline balance for Polymarket-related addresses is taken from mainnet block 96,399,251 (October 29th), while the Binance address uses block 96,413,185 as its reference point.

Limitations of Current Blocking and Attacker Actions

While the current blacklist has effectively blocked fund movements with no apparent workarounds found yet, the proposal acknowledges it as a temporary measure. Each block producer reads its own blacklist upon startup, and any updates require redeployment, Bor restarts, or span rotations. The blacklist entries do not automatically expire, and the filtering is limited to outer senders and EIP-7702 authorizers, not a comprehensive asset freeze.

The attackers have also been active. On October 30th, a pending transaction with a fee of approximately 219,450 POL (10.45 POL per gas unit) appeared on-chain. The proposal also mentions that attackers have approached validators, offering cash in exchange for assistance in unlocking transactions. Polymarket has initiated a recovery channel on-chain through SEAL’s Safe Harbor Recovery account but has not yet received a response.

Hard Fork Mechanism and Recovery Wallets

According to the proposal’s design, starting from block F, and before any transaction execution, the system will read the balance of each Class A address at the end of block F-1. This balance will be zeroed out, and an equivalent amount of POL will be credited to the corresponding recovery address. The four addresses from the Polymarket incident will have their funds credited to Polymarket’s recovery wallet, and the Binance address will have its funds credited to Binance’s recovery wallet.

This process will not alter the total POL supply. Class B addresses will remain unaffected, and contracts such as Heimdall, StakeManager, and the cross-chain bridge will also remain untouched.

Recovery Wallet Verification and Governance Process

The proposal mandates that before the formal activation, both platforms must publicly disclose their recovery wallet addresses in the discussion thread. They must also provide proof of control, such as signing a message or making a small test transfer from the address, which will be confirmed by Polygon Labs. Written confirmation that the address indeed belongs to them is also required. If multi-signature wallets are involved, the signers will also be disclosed.

The proposal is scheduled for presentation at the Polygon Protocol Governance Call (PPGC) on November 5th at 14:30 (UTC). Following approval, client development and Amoy testnet deployment and rehearsals are estimated to take approximately two weeks, though it could be compressed to one week under tight scheduling. Validators, RPC providers, and block explorers will be notified before the mainnet launch. The Polygon validator operations team anticipates that 70% to 80% of staked amounts will quickly upgrade to the specified version before the official activation at block F.

Strict Conditions for Activation

The conditions for proceeding are stringent: the PIP must complete the governance process, investigation reports from both parties must remain public and consistent with on-chain records, all block producers’ blacklists must remain effective until the fork, and Class A balances must be re-read at the snapshot block, with any changes publicly disclosed.

After activation, the team will publish balance changes and validation scripts excluding transactions. The blacklist will be reviewed, and Class B entries will be removed upon confirmation from Binance.

Precedent and Decentralization Concerns

Zeroing out balances and crediting them to different addresses is fundamentally an act of overwriting private key ownership with consensus rules. The proposal acknowledges this as one of the most sensitive operations on-chain: “moving user balances.”

Consequently, the scope is strictly limited to a one-time, closed-list, designated block operation, and the document explicitly states it should not be used as a regular practice. This approach mirrors Gnosis Chain’s hard fork to recover funds in the Balancer hack, indicating that “on-chain freezing combined with governance forks” is becoming a standard asset recovery procedure for large platforms. However, each such intervention redraws the line between decentralization and victim relief, and the accumulation of precedents makes it increasingly difficult to refuse future requests.