A Polygon Improvement Proposal seeks to recover 70.49 million POL from five addresses linked to the Binance and Polymarket security incidents. The proposed fork would reassign native POL bala
Polygon could undertake an exceptional blockchain intervention to recover approximately $6.5 million in stolen POL following separate security incidents involving Binance and Polymarket.
A Polygon Improvement Proposal published on November 4 calls for a coordinated hard fork that would remove native POL from identified attacker-controlled addresses and transfer equivalent balances to verified recovery wallets.
The proposal, submitted by Parvez03 of the Polygon Labs Validator Support Team, is scheduled for discussion at the Polygon Protocol Governance Call on November 5. No activation block or client release has been approved.
The proposed intervention follows the October 29 and 30 incidents, after which Polygon PoS block producers restricted transactions from addresses associated with the stolen funds.
The affected balances are divided between four Polymarket-linked wallets and one Binance-linked wallet.
Polygon’s Proposed POL Recovery Native POL balances identified in the PIP Incident POL Wallets Share Binance 46.63M 1 66.2% Polymarket 23.86M 4 33.8% Total 70.49M 5 100% Distribution of proposed recovery Source: Polygon Community Forum, November 4, 2026. Shares calculated from rounded balances. The $6.5M valuation uses October 29 prices.The Polymarket incident involved a larger overall amount than the funds targeted by the proposed fork. The recovery is restricted to balances still held in the specified addresses, rather than every token associated with the original exploit.
The Binance-related address also received approximately 6.19 million USDT from a hot wallet. Tether subsequently froze those stablecoins, leaving the native POL balance as the focus of this intervention.
Polygon’s existing restrictions have prevented the identified funds from moving, but the PIP describes the arrangement as operationally fragile.
Bor block producers load their transaction block lists when starting their nodes. Updating those restrictions requires coordinated deployment and a restart or validator span rotation.
A node restarted with an outdated or missing list could create an opportunity for prohibited transactions to be included, depending on the other active producers and network conditions.
The proposal also identifies limits in the filtering mechanism itself. It covers outer transaction senders and EIP-7702 authorities, rather than every possible route through which assets might move.
The author reports that an attacker attempted to submit a transaction offering approximately 219,450 POL in fees and approached validators with payment offers intended to secure assistance in releasing blocked funds.
These incidents are presented in the PIP as evidence of continuing attempts to circumvent the restrictions, not proof that the block lists have already failed.
Polymarket also established an on-chain recovery channel through the SEAL Safe Harbor mechanism, according to the proposal, but received no response.
The proposed fork would replace this continuing dependence on transaction filtering with a one-time consensus-level balance reassignment.
At a predetermined activation block, the affected POL balances would be debited from the listed addresses and credited to institution-controlled recovery wallets. Aggregate supply would remain unchanged.
The proposal deliberately distinguishes between addresses selected for recovery, classified as Class A, and additional Binance-related addresses designated Class B.
Binance’s Hot Wallet 34 is a smart-contract wallet that accepts ERC-4337 UserOperations. Such operations can be executed through mechanisms that a simple sender-based transaction filter does not necessarily capture.
The draft therefore excludes Class B addresses from the proposed balance reassignment.
Sweeping those wallets could introduce attribution errors or affect assets that do not belong exclusively to the attacker.
This narrower scope limits the intervention to addresses for which the proposal provides specific transaction evidence.
It also leaves a residual operational problem: the hard fork would recover the selected native POL balances, but it would not automatically resolve every security or transaction-filtering concern associated with the broader incidents.
Approval at the November 5 governance discussion would begin a technical process rather than trigger an immediate mainnet balance change.
The PIP requires verified recovery addresses, a Bor client update and testing on Polygon’s Amoy testnet.
The proposed tests would confirm that the targeted balances move correctly, unrelated accounts remain unchanged and aggregate supply is preserved.
A separate mainnet-fork rehearsal would test the state transition against recorded balances.
The author estimates approximately two weeks for development and testing after approval.
The proposal also notes that validators representing an estimated 70% to 80% of stake could adopt the necessary software relatively quickly. That projection is not a confirmed commitment.
Any node failing to upgrade before activation would follow an incompatible chain, creating a potential chain split.
Explorers, indexers and accounting systems would also need to recognize the exceptional balance adjustment, because it would not appear as an ordinary token transfer executed by a transaction.
The proposed intervention would not establish a permanent recovery function within Polygon PoS. The PIP explicitly rejects that alternative because it would create an enduring mechanism for moving user funds without their authorization.
Instead, the author proposes a closed address list, institution-verified recipients and a single activation event tied to publicly acknowledged incidents.
That structure reduces the scope of the intervention but does not eliminate its governance implications.
Polygon validators would be asked to authorize a balance change without the private keys controlling the affected addresses, based on evidence presented by the victims and the proposal’s author.
The central trade-off is between recovering assets from identified thefts and preserving the expectation that blockchain balances cannot be reassigned through governance decisions.
The proposal attempts to limit that precedent through strict conditions, but future recovery requests could still invoke the decision.
POL traded near $0.09650 on November 5, according to the Coinbase daily chart from TradingView.
POL regains key moving averages as buyers target resistance near $0.10. Chart by Alexander Zdravkov
Its 14-day RSI stood at 52.96, indicating improving momentum, although the chart does not establish a direct relationship between price action and the proposed recovery.
The November 5 governance call, scheduled for 14:30 UTC, is the next decision point. The funds will remain restricted unless a recovery mechanism is approved and successfully implemented.
The post Polygon Fork Proposal Aims to Reclaim Stolen Hack Funds appeared first on ETHNews.
