Polygon Eyes Hard Fork to Recover 70.49 Million POL Stolen in Polymarket and Binance Hacks

The proposal targets native POL only, leaving Binance's already-frozen USDT untouched. Polygon is considering a hard fork proposal that would move around 70.49 million POL stolen in separate security incidents involving Polymarket and Binance back to recovery wallets designated by the two platforms.

The incidents took place on October 29 and 30, with roughly 23.86 million POL linked to the Polymarket incident and another 46.63 million POL connected to Binance. Following requests from the affected platforms, all validator-elected block producers added the identified addresses to their Bor transaction block lists.

Temporary Measures

While the block lists stopped the funds from moving, Polygon describes the arrangement as a stopgap rather than a permanent solution. The block lists are read only when a block producer starts up, requiring deployment and Bor restart for updates, leaving room for potential bypass attempts.

Recovery Plan

Under the proposal, the balances of four Polymarket-linked addresses and one Binance-linked address would be transferred at a fixed block height. Both platforms will have to prove control of their respective recovery addresses and confirm in writing that they are authorized to receive the funds.

Polygon also pointed to an attempted transaction involving a fee of around 219,450 POL and an alleged approach to validators offering cash in exchange for help unblocking a transaction. The proposal only covers native POL held at the five listed addresses, while other tokens remain outside its scope.

Before the change reaches mainnet, it must pass the Polygon governance process, undergo development and testing on Amoy, and receive the required validator support.