A member of the Polygon Labs Validator Support Team has proposed a coordinated hard fork of the Polygon Proof-of-Stake network to recover approximately 70.49 million POL tokens, worth about $6.5 million, stolen during separate security incidents involving Binance and the prediction market Polymarket. The proposal, published on the Polygon governance forum on November 4, 2026, is scheduled for discussion during the Polygon Protocol Governance Call on November 5 at 14:30 UTC.
The proposed intervention targets five attacker-controlled addresses. Four of these addresses, holding about 23.86 million POL, are associated with the Polymarket security incident that took place on October 29. A single address linked to the Binance breach contains approximately 46.63 million POL. The total combined value is based on POL's October 29 price of $0.0924.
Polygon's block producers have already placed the five addresses on transaction block lists, effectively preventing the attackers from moving the stolen assets. However, the existing restrictions do not provide a mechanism to return the funds to their rightful owners. The proposal argues that maintaining these wallet restrictions indefinitely creates operational risks, as block producers must update and enforce their own block lists, and that a one-time protocol-level state change is a more permanent solution.
The hard fork would remove the native POL balances from the five identified addresses and credit equivalent amounts to verified recovery wallets controlled by Binance and Polymarket. Crucially, no additional POL would be created, meaning the cryptocurrency's total supply would remain unchanged. The transfer would occur through a network-level state change at a predetermined block, rather than conventional transactions requiring the attackers' private keys. The proposal explicitly rejects creating a general recovery mechanism, emphasizing that this is an "extreme action that should not be reproduced commonly" and that permanent authority to move user funds would raise concerns about control over blockchain assets.
If governance approval is granted, developers would prepare updated network software and test the recovery mechanism on Polygon's Amoy testnet. Development and rehearsals are estimated to take approximately two weeks following approval. Before activation, Binance and Polymarket would need to demonstrate control of their designated recovery wallets and confirm the addresses in writing. Validators and infrastructure providers would then need to upgrade their software before the selected activation block. The proposal warns that nodes failing to upgrade could continue following an incompatible version of the blockchain, creating a potential chain-split risk.
The broader context is significant for the crypto industry. The Binance incident, which occurred separately from the Polymarket breach, involved unauthorized withdrawals across multiple blockchains, with a hot wallet transferring approximately 46.63 million POL and 6.19 million USDT to an attacker-controlled address. Tether subsequently froze the USDT. The proposal's author alleges that the attacker attempted another transaction on October 30 and even contacted validators offering cash payments in exchange for assistance moving the funds. Polymarket reportedly attempted to contact the attacker through an onchain recovery channel but received no response.
This governance decision raises fundamental questions about blockchain immutability and decentralization. While the proposal is narrowly defined to a one-time adjustment for five specific addresses linked to publicly acknowledged security incidents, it still tests the boundaries of whether blockchain participants can collectively reverse transactions under exceptional circumstances. The document argues that the measure is justified by identifiable stolen assets and existing transaction restrictions, but the outcome remains uncertain pending governance approval, technical implementation, and validator coordination.
