Polygon Proposes Hard Fork to Recover 70.5 Million Stolen POL From Binance and Polymarket Hacks

Published November 5, 2026, 1:15 PM PKT. Based on the Polygon Improvement Proposal posted on the Polygon forum on November 4, 2026 (primary source), and reporting by Crypto Briefing, crypto.news and FXStreet on November 5, 2026 (secondary reporting).

Polygon has proposed a hard fork of its Polygon PoS network to recover about 70.49 million native Polygon ($POL) sitting in five attacker-controlled addresses, frozen since the October 29-30 security incidents at Polymarket and Binance. The Polygon Improvement Proposal, posted on the Polygon forum on November 4, 2026 by Parvez03, a member of the Polygon Labs validator support team, would set each listed address balance to zero at a fixed block and credit the same amounts to recovery wallets verified by the two victims. The proposal values the haul at about $6.5 million at the October 29 spot price of $0.0924 per POL, and it calls the move an extreme action that should not be reproduced commonly. The stakes go beyond the money: moving a balance without the owner's key is the most sensitive action a chain can take, and the proposal goes before Polygon validators at the Protocol Governance Call on November 5 at 14:30 UTC, or 7:30 PM PKT.

The proposal: zero the balances, credit the victims

The mechanics are a one-time state change, not a reversal of transactions. At the start of a designated activation block, known in the proposal as block F, before any transaction in that block executes, each of the five listed Class A addresses would have its native POL balance read from the previous block, set to zero, and the same amount credited to the recovery address of the victim that presented it. Polymarket's recovery address is 0x3dcE0a29139A851Da1dFCa56Af8e8a6440b4D952 and Binance's is 0xd9fd39103674cb061d64d9c3b73b878dbe610b80, both published in the proposal. Total supply would not change, no new tokens would be minted and none burned. Only native POL is in scope: the proposal leaves other tokens untouched, including the 6,185,900.1 Tether ($USDT) that arrived with the Binance funds and has already been frozen by Tether. Before activation, each victim must prove control of its recovery address, for example with a signed message or a small test transfer confirmed by Polygon Labs, and confirm in writing that the address is theirs to receive the funds. Class B addresses that Binance supplied later are not swept, and Heimdall, the StakeManager and the bridge contracts are unchanged. Nodes that do not upgrade before block F would follow a different chain from that block onward.

70.49 million POL across five blocked addresses

The money traces to two separate incidents on October 29 and 30. In the Polymarket incident, about 28 million POL was involved on Polygon PoS, and the proposal says 3,282,275.71 POL moved in two native transfers at 18:30:34 and 18:35:59 UTC on October 29, from address 0xe4C4...1EC6 to 0x3f70...1Ffa. Four Polymarket-linked addresses now hold about 23.86 million POL, with the largest holding about 15.33 million. Polymarket's post-mortem, cited in the proposal, said a compromised third-party script used active sessions to sell users' positions and drain wallets. In the Binance incident, a Binance hot wallet sent 46,626,589.6 POL and 6,185,900.1 Tether ($USDT) to address 0x5227...2f8c in block 96,406,484, late on October 29. That single address now holds about 46.63 million POL. Binance's own account, also cited in the proposal, said an attacker exploited unauthorized access to an internal wallet-signing service during the October 29 hack, the largest crypto theft on record at about $6.3 billion, which MABOnChain has covered in depth. The POL in the five addresses is a small slice of that hack, but it is the slice that landed on Polygon and stayed there.

Why a block list cannot return the money

The funds are already frozen, and that is exactly the problem the proposal tries to solve. At the request of Polymarket and Binance, the Polygon PoS block producers, identified in the proposal as anonymous-91 to anonymous-94, added the five addresses to the Bor transaction block list, which stopped the funds from moving. No bypass has been found, but the proposal is blunt that the block list is a stopgap, not a recovery. Each producer reads its list only at startup, so every change needs a deployment and a Bor restart or span rotation, entries have no automatic expiry, and the filter covers only outer senders and EIP-7702 authorities, so it is not a complete asset freeze. The attacker keeps trying: the proposal records a pending transaction paying a fee of about 219,450 POL observed on October 30, and says the attacker has contacted validators offering cash payment in exchange for help unblocking a transaction. Polymarket opened a recovery channel to the attacker on-chain through the SEAL Safe Harbor Recovery safe and received no response. Leaving about 70 million POL locked indefinitely, the proposal argues, is neither a stable end state nor a return of funds to their owners. A coordinated hard fork is the only technical path, because moving a balance without the owner's key requires a consensus change.

An extreme action, with six conditions

The proposal sets six checkable conditions for the intervention, and says each one is met. The hacks are publicly acknowledged by the victims in their post-mortems, every block producer has blocked the addresses, the sum is meaningful at about $6.5 million, the funds trace on-chain to known and reputable victims, the affected parties themselves requested the remedy and are the proposers of the PIP, and after public statements no party with a right to the funds has contested the circumstances. The proposal rejects the alternatives it considered: leaving the funds locked would freeze about 70 million POL permanently on a mechanism designed as a short-term stop, a negotiated return depends on the attacker's cooperation and cannot be relied on, and a general freeze-and-recover power in the protocol was rejected outright because it would be a permanent power over user funds. The security section is equally direct about the risks: if an address on the list is not attacker-controlled, a legitimate balance would be moved, which is why each Class A address is tied to on-chain transfers in the proposal and why Binance's Class B addresses are not swept. A fake or compromised recovery address would send funds to the wrong party, which is why proof of control and written confirmation are required before activation. Validators that do not upgrade would fork off, so the rollout plan calls for an Amoy testnet rehearsal, advance notice and a release date set only after stake coverage is confirmed.

What happens next: the November 5 governance call

The proposal is scheduled for presentation at the Polygon Protocol Governance Call on November 5, 2026 at 14:30 UTC, or 7:30 PM PKT. It has no fork name, no activation block and no client release yet: all three are marked to be decided once approved. If validators approve it, the proposal views about two weeks after approval as workable for client development and the Amoy deployment and rehearsal, with one week described as tight, and Polygon validator operations expects about 70 to 80 percent of stake to reach the required version quickly after release. Before mainnet, validators, RPC providers and explorers would be notified, and after the fork the balance change and a verification script would be published. The decision matters beyond Polygon because it tests whether a major chain will rewrite balances to undo a theft when the victims ask, the funds are traceable and the amount is large, and whether other chains facing the same question will treat this as a precedent or as the one-off the proposal insists it is.

Sources

• Polygon Forum, PIP Proposal: Recovery of Funds Held in Blocked Addresses following the Polymarket and Binance Incidents, November 4, 2026 (primary source: 70.49 million POL across five addresses, 23.86 million Polymarket and 46.63 million Binance, $6.5 million at $0.0924 per POL on October 29, block list limits, attacker fee transaction and validator contact, recovery addresses, fork mechanics, six conditions, governance call November 5 at 14:30 UTC, about two weeks to mainnet after approval)
• Crypto Briefing, Polygon proposes hard fork to recover $7M in stolen Binance, Polymarket funds, November 5, 2026 (secondary reporting: proposal introduced November 4 by Parvez03, Polymarket and Binance incidents, governance call November 5 at 14:30 UTC, about two weeks of development and testing if approved)
• crypto.news, Polygon considers hard fork to return $6.5M stolen in Binance, Polymarket hacks, November 5, 2026 (secondary reporting: 70.49 million POL, $6.5 million at October 29 price, block producers restricted five addresses, proposal scheduled for discussion November 5 at 14:30 UTC)
• FXStreet, Polygon Labs considers a hard fork to recover assets from Polymarket and Binance hacks, November 5, 2026 (secondary reporting: Polymarket post-mortem on compromised third-party script, Binance $6.3 billion hack, six conditions, implementation expected to take roughly two weeks if approved)

This article is news reporting and is not investment advice.