Polygon Weighs a Hard Fork to Move 70.49M POL Back to Victims

Polygon's validators are being asked to do something a public blockchain is built to prevent. A Polygon Improvement Proposal filed on 4 November would hard-fork the proof-of-stake mainnet, set five attacker-controlled addresses to zero and credit the same balances to recovery wallets named by Binance and Polymarket. The sum sitting in those addresses is 70.49 million POL, frozen since the end of October. The proposal, from a Polygon Labs validator support team member posting as Parvez03, calls the step extreme and warns against reproducing it. It goes to Polygon's Protocol Governance Call at 14:30 UTC on Thursday.

Where the tokens came from

Two incidents, a day apart. Polymarket suspended trading on 29 October after a security incident involving a third-party provider, The Crypto Times reported. The next day a Binance hot wallet sent 46.63 million POL and 6.18 million USDT to an address tied to the attacker, part of the $6.3 billion hot wallet theft the exchange disclosed on 30 October. Crypto Briefing and The Crypto Times put the Polymarket leg at about 23.86 million POL across four addresses. FXStreet, reading Polymarket's own final incident report, writes that roughly 28 million POL reached Polygon PoS, about 24 million of it frozen on request. Those accounts describe different quantities at different moments, and we could not establish which balance the fork would act on. Only the total is agreed. What that total is worth is not: Crypto Briefing says around $7 million, The Crypto Times approximately $6.5 million at POL's 29 October price of $0.0924. The two do not reconcile, and the proposal fixes neither: the final amount depends on balances recorded immediately before the fork.

A block list that leaks

The five addresses already sit on the Bor transaction block list Polygon's block producers maintain, and the proposal treats it as a stopgap. FXStreet set out why. Each producer loads the list only at startup, so a change needs a restart or a span rotation. Entries never expire on their own, and the filter catches only certain transaction types. The attackers have been testing it. Both FXStreet and The Crypto Times describe attempts to push the assets out through high-fee transactions, and approaches to validators offering payment. The Crypto Times alone reports a pending transaction carrying a proposed fee of about 219,450 POL. That detail rests on one outlet.

Leaving the funds blocked is "neither a stable end-state nor a return of funds to their owners," the proposal said.

What a yes would start

Approval would change nothing on its own. Developers would cut a client release and rehearse on the Amoy testnet, which the proposal estimates at roughly two weeks before any mainnet activation. The activation block has not been set. Validators, RPC providers, exchanges and node operators would all have to upgrade; nodes that did not would follow a different chain from the fork block. The proposal names that risk itself, next to the risk of wrong attribution. Each company would prove control of its recovery wallet by signed message or test transaction, then confirm ownership in writing. Balances would be rewritten at the start of a chosen block, not undone. Total supply would not move: nothing is minted or burned.

The fence around the precedent

The change covers native POL in five addresses and nothing else, so other tokens from the incidents fall outside it, including the USDT, which The Crypto Times says Tether has already frozen. That claim appears in one account. FXStreet reports the PIP lists six conditions meant to keep the case from generalising, among them public acknowledgment by the victims. That list comes from a single outlet. Leaving the money locked and writing a permanent recovery mechanism into the protocol were both dropped. Core DAO reached for the same instrument after validators drew excess CORE. One more thing did not check out. Crypto Briefing and The Crypto Times date the governance call to 5 November at 14:30 UTC, FXStreet calls it Wednesday, and 5 November is a Thursday. As of the time of writing the tokens are blocked, not recovered, and nobody has voted.