Mentioned in This Article
1. A Polygon hard fork proposal to return 70.49 million stolen POL
A proposal posted to Polygon's governance forum on November 4 asks the network to carry out a hard fork that would take about 70.49 million POL out of five addresses controlled by attackers and hand it to recovery wallets run by Binance and Polymarket. The tokens were stolen in separate incidents at the two platforms, and discussion of the plan was scheduled for November 5.
The request is unusual because it asks a public blockchain to change account balances directly instead of waiting for a thief to move funds or surrender keys. Polygon's block producers have already blocked transactions from the affected addresses at the platforms' request, so the tokens are stuck in place. The proposal's authors argue that this freeze is only a stopgap and that a protocol-level change is the sole way to return the assets to their owners.
Because the plan touches the question of whether a network should ever reverse the effects of a theft, it has drawn attention well beyond the two companies involved. The details of the proposal, the way the fork would work, and the steps that remain before anything could take effect are set out below.
2. How the stolen POL is divided between Binance and Polymarket
The proposal splits the frozen tokens between the two victims. About 23.86 million POL sits across four addresses connected to the Polymarket incident. Roughly 46.63 million POL is held in a single address connected to the Binance incident. Together the two amounts come to the 70.49 million POL that the fork is meant to recover.
Polymarket is the prediction market platform that suffered a separate security incident, while Binance is the exchange that was hit by a large theft earlier. The two events are not described as a single coordinated attack, and the proposal treats them as distinct losses that happen to have left stolen tokens on the same network. That is why the plan lists five attacker-controlled addresses: four for one platform and one for the other.
POL is the native token of the Polygon network, used to pay transaction fees and to secure the chain through staking. Because the stolen tokens are native to the network itself and not an asset issued by a third party, no outside issuer can freeze or reissue them. That distinction matters here. Stablecoin issuers can blacklist an address and mint replacement tokens, but nobody holds a comparable switch for a network's own coin, which is how the discussion arrived at the idea of a hard fork.
The amounts also differ in how they were held. The Binance-linked tokens sit in one address, which makes the intended change simple to describe, while the Polymarket-linked tokens are spread across four. Any implementation has to list each address precisely, since a mistake in a single entry would either leave stolen tokens behind or move tokens that belong to someone else.
3. What is a hard fork, and how would this one work?
A hard fork is a change to a blockchain's rules that is not backward compatible: nodes must install the new software to keep following the chain, and the new rules apply from a specific block onward. Networks use them for routine upgrades, and they have occasionally used them in emergencies. In this case the change would be narrow and targeted.
Under the proposal, the fork would reduce the balances of the five attacker-controlled addresses and credit the same amounts to verified recovery wallets designated by Polymarket and Binance. The transfer would take place at a block number fixed in advance. The total supply of POL would not change, since the tokens would be moved and not created or destroyed.
The design differs from a general rollback. Transactions before and after the chosen block would remain intact, and only the listed addresses would be touched. Supporters of such narrow fixes say this limits the precedent, because the change is tied to named addresses and a specific set of incidents. Critics respond that any intervention of this kind, however narrow, shows that balances on the network can be edited when enough participants agree.
The proposal also leaves several practical details open. The block at which the transfer would run, the name of the fork and the client release that carries it have not been settled, and no mainnet date has been confirmed.
4. Why is a transaction freeze not enough?
Polygon's block producers, the operators who assemble blocks on the network, have already refused to include transactions from the affected addresses. That prevents the attackers from moving or selling the stolen POL, which is the most urgent problem after a theft. The proposal describes the restriction as temporary, however, and says it cannot by itself return the funds to the people who lost them.
A freeze depends on the continued cooperation of the producers. If they change their policy, rotate out, or come under pressure, the restriction could lapse. It also leaves the tokens in limbo: they are neither usable by their rightful owners nor available to the thieves. For the victims, a permanent resolution requires either a fork that reassigns the tokens or a negotiated surrender of the keys by the attackers, and nothing in the proposal suggests the second is likely.
That reasoning explains why the authors moved from a freeze to a protocol change. They present the fork as the way to finish what the freeze started, with the recovered tokens going to wallets that the companies have to prove they control.
There is also a trust element. Block producers who agree to censor addresses are exercising discretion that the network's design does not formally grant them, and the community has to decide whether to endorse that discretion after the fact. A fork that settles the matter in a single, public step replaces ad hoc decisions by individual operators with a rule that every validator can inspect, which supporters regard as the more transparent route.
5. What conditions come before any activation?
The plan does not take effect on its own. It needs governance approval from the Polygon community and has to be tested on the Amoy testnet, the network's test environment, before any mainnet activation. Discussion of the proposal was scheduled for November 5, and no activation date has been confirmed.
The proposal also asks Binance and Polymarket to prove ownership of the recovery wallets to Polygon Labs and to confirm the arrangement in writing before the fork goes ahead. The step is meant to make sure the recovered POL reaches the right parties and not another account that merely claims to represent the victims.
Testing matters for a change of this kind. A hard fork that moves balances has to be implemented in the node software that validators run, and any bug in the transfer logic could affect the whole network. Running the change on a testnet first lets developers and validators check that exactly the five addresses are affected, that the amounts match, and that supply stays constant.
6. The governance question: should a network edit balances?
Public blockchains are valued partly because their records are hard to alter. A fork that rewrites balances after a theft challenges that expectation, and the debate over such steps has a long history in the industry. Proponents argue that returning stolen funds to victims is a legitimate use of network governance, particularly when the amounts are small relative to the network and the thieves are identifiable by their addresses.
Opponents worry about precedent. If a network moves tokens at the request of two prominent companies, they ask, what would stop future requests from other well-resourced parties, and where would the line be drawn between theft and a dispute? Some also point out that the attackers refused to hand over their keys, which leaves the community with a choice between leaving funds frozen indefinitely and altering state by decree.
The size of the recovery is modest by the standards of recent thefts, but the principle is what makes the proposal contentious. The outcome will show how far Polygon's validators and token holders are willing to go in using governance to correct the consequences of a security failure at a centralized platform.
For users who hold POL, the practical effect of the proposal is limited to the five listed addresses, and ordinary transfers, staking and fee payments are not part of the plan. Still, validators and application developers who run Polygon software would need to upgrade if the fork is approved, which is why the proposal stresses testing and a clear release process.
7. Background: why the two platforms were targeted
The proposal arrives after a record-setting theft at Binance, which took place on October 29, and after a separate Polymarket incident in which the platform temporarily suspended trading after a third-party provider was reported compromised. The tokens involved in this plan are the part of those losses that stayed on Polygon and could be frozen in place.
Centralized platforms hold large pools of customer assets, and attackers frequently route stolen funds across several networks to make recovery harder. When some of the proceeds land on a chain where validators can act, as happened here, the response can include freezes and, in this case, a proposal to reverse the transfer. Funds that move through mixers or cross-chain bridges are generally harder to stop.
The Polygon request therefore covers only a portion of the overall losses, namely the POL that never left the network and that block producers were able to block.
8. What happens next?
The next step is the governance discussion that was scheduled for November 5, where validators, developers and token holders can raise objections or ask for changes. The proposal's authors will then need to settle the activation block, the fork's name and the client release. Testing on Amoy is required before any mainnet date is announced.
Readers should treat the plan as a proposal and not as a decision. It could be amended, delayed or rejected, and nothing moves until the community approves it and the software is released. If it proceeds, the fork would transfer 70.49 million POL from five attacker-controlled addresses to recovery wallets for Binance and Polymarket without changing the token's total supply.