Polygon governance weighs hard fork to reclaim roughly $6.8 million in POL stolen from Binance and Polymarket. On November 4, 2026, a Polygon Improvement Proposal appeared on the network’s community forum calling for a coordinated hard fork of the Polygon Proof-of-Stake chain.
The measure would zero out the native POL balances of five attacker-controlled addresses and credit equivalent amounts to verified recovery wallets designated by Binance and Polymarket.
The tokens total approximately 70.49 million POL, valued near $6.8 million at recent prices, and currently sit frozen after separate security incidents on October 29 and 30.
Roughly 23.86 million POL remains across four addresses linked to the Polymarket episode, while about 46.63 million POL sits in a single address tied to the Binance incident.
In the Polymarket case, around 28 million POL was involved on Polygon; block producers blocked the four listed addresses holding the bulk of it. For Binance, a hot-wallet transfer in one block sent the large POL sum (plus USDT later frozen by Tether) to the attacker address.
Both platforms publicly acknowledged the breaches and requested the blocks.
Polygon’s validator-elected block producers added the addresses to the Bor transaction block list, preventing further movement.
That filter, however, is only a temporary stopgap.
It is read at node startup, requires restarts for updates, lacks automatic expiry, and does not constitute a full asset freeze.
The proposal notes that attackers have continued attempts to bypass it, including a high-fee pending transaction and reported offers of payment to validators.
Leaving tens of millions of POL locked indefinitely is neither operationally stable nor a return of the funds to their owners.
The proposed hard fork would activate at a predetermined block height.
At the start of that block, before any transactions execute, the native POL balance of each listed address would be set to zero and the same quantity credited to the corresponding recovery address—one controlled by Polymarket and one by Binance.
Total POL supply would remain unchanged; the operation is limited to native balances of the five specified addresses.
Recovery-address ownership must be verified beforehand through signed messages or test transfers and written confirmation.
Other tokens and additional addresses flagged by Binance fall outside the scope.
The plan requires standard Polygon governance approval. It is scheduled for discussion at the Protocol Governance Call on November 5 at 14:30 UTC.
If approved, client development and rehearsal on the Amoy testnet are expected to take roughly two weeks, after which the activation block, fork name, and client release would be finalized.
Validators, RPC providers, and other node operators would need to upgrade before the fork height; nodes that do not would diverge.
Proposers describe the step as extreme and not a general recovery mechanism or precedent.
They list specific conditions that are met here: public acknowledgment by the victims, universal blocking by block producers, a meaningful sum, clear on-chain tracing to reputable parties, the victims themselves requesting the remedy, and the absence of competing claims after public disclosure.
Alternatives such as indefinite freezing or reliance on attacker cooperation were considered less viable.
The proposal follows a record Binance security incident estimated at roughly $6.3 billion in stolen assets (with substantial freezes and company coverage of losses) and a separate Polymarket episode in which a compromised third-party provider led to unauthorized drains, temporary trading pauses, and platform reimbursements to affected users. The PIP focuses solely on the blocked native POL still on Polygon.
