Polygon Plans Hard Fork After $70M POL Theft

Polygon Considers Hard Fork to Reclaim Stolen POL Tokens

Polygon is contemplating a significant network upgrade, a hard fork, aimed at recovering approximately 70.49 million POL tokens that were pilfered in separate security breaches affecting Polymarket and Binance. The proposed solution would reroute these stolen assets to recovery wallets established by the respective platforms.

The plan hinges on Polygon PoS validators endorsing a coordinated network enhancement. This upgrade would effectively zero out the balances in five addresses controlled by attackers and simultaneously credit identical amounts to verified recovery addresses. While the stolen funds are currently immobilized, Polygon has stated that the existing blocking mechanism lacks the capability to return them to their rightful owners.

The security incidents occurred on October 29 and 30. Roughly 23.86 million POL were linked to the Polymarket breach, with an additional 46.63 million POL connected to the Binance incident. In response to requests from the affected platforms, validator-elected block producers collectively added the identified attacker addresses to their Bor transaction block lists. This action successfully halted the movement of the funds. However, Polygon characterizes this measure as a temporary fix rather than a sustainable solution.

The current block list system is only consulted when a block producer initiates its operation. Consequently, any modifications necessitate a full deployment and a restart or rotation of the Bor system. Furthermore, this filtering method is not foolproof and presents potential avenues for circumvention, as it does not encompass all conceivable transaction pathways.

Polygon also highlighted an attempted transaction that involved a substantial fee of approximately 219,450 POL. Additionally, there were reports of an alleged attempt to bribe validators with cash in exchange for assistance in unblocking a transaction. Under the proposed hard fork, the balances held in four Polymarket-related addresses and one Binance-related address would be transferred at a predetermined block height.

Both Polymarket and Binance will be required to demonstrate ownership of their designated recovery addresses and provide written confirmation that they are authorized to receive the recovered funds.

This proposed fork is specifically designed to address native POL tokens held within the five compromised addresses. Other token types are not included in this initiative. Notably, USDT stolen from Binance has already been frozen by Tether, rendering it outside the scope of this proposed fork. Polygon has emphasized that this is an exceptional measure and should not set a precedent for regular fund freezing and recovery operations.

Prior to its implementation on the mainnet, the proposed change must successfully navigate Polygon’s governance procedures, undergo development and testing on the Amoy testnet, and secure the necessary support from validators.