A Polygon Labs team member proposed a hard fork on November 4, 2026, to recover about 70.49 million stolen POL from five frozen addresses. The tokens, tied to separate Binance and Polymarket breaches, are worth roughly $6.8 million at current prices.
At a Glance
- Polygon block producers have blocked five addresses holding about 23.86 million POL from Polymarket and 46.63 million POL from Binance.
- The proposed fork would move those balances to recovery wallets, so the total POL supply would stay the same.
- Binance and Polymarket must prove they control their recovery wallets and confirm them in writing before activation.
- The proposal goes before the Polygon Protocol Governance Call on November 5 at 14:30 UTC.
A blacklist stops the tokens but cannot return them
Parvez03, a member of the Polygon Labs Validator Support Team, posted the recovery proposal on the Polygon forum. It covers only the identified POL balances, not every asset lost in either incident.
The four Polymarket addresses hold POL worth about $2.31 million today. Roughly 28 million POL moved during that attack, so the fork would not recover all of it. The single Binance address holds about $4.51 million in POL. The proposal itself prices all five balances at $6.5 million, using the October 29 rate of $0.0924.
The Binance transfer also carried 6.19 million USDT. Tether has since frozen it, a step the issuer has taken in earlier enforcement cases. That leaves native POL as the balance at risk.
Today, the DIFC Courts published a whitepaper proposing a way for court decisions to be carried out on tokenized assets. Polygon Labs has contributed as a peer reviewer of The Dispute Resolution Oracle, alongside @Deca4HQ. Read it here: https://t.co/2OkapCPKGT
— Polygon (@0xPolygon) November 5, 2026
Validators enforce the current freeze through block lists they load when a node starts. Every change needs a software update plus a restart of Bor (Polygon’s block-producing client) or a span rotation. The attacker has tested those limits. One queued transaction offered a fee of about 219,450 POL, and validators received cash offers to unblock a transfer.
The proposal puts it bluntly: indefinite lockup is “neither a stable end-state nor a return of funds to their owners.“
The fork rewrites five balances at one block
At a chosen block, before any other transaction runs, the upgraded client would zero each listed balance. It would then credit the same amount to the matching recovery wallet. Only native POL moves, and unlisted tokens and addresses stay untouched.
Binance and Polymarket can prove wallet control with a signed message or a test transaction. Activation also depends on four conditions:
- Approval through Polygon’s governance process
- Published post-mortems that match the on-chain record
- Block lists staying in force on every block producer until activation
- A fresh read of the balances at the snapshot block, with any changes published
After approval, developers would build the client and rehearse on the Amoy testnet. The proposal treats about two weeks as a workable window and calls one week tight. Validators, RPC providers and block explorers then need the update, and enough stake must switch over to avoid a chain split.
Polygon pitches the recovery as a one-off
Polygon has forked under pressure before. A December 2021 hard fork patched a critical bug, and a later fork fixed a software fault that delayed transaction finality. Both repaired code. This one would reassign specific coins without the holder’s private key. That is new ground for a crypto exchange hack recovery.
The proposal acknowledges the shift. Its authors call the move an extreme action that shouldn’t become common, and they tie it to these two incidents alone. Validators may still see a precedent, because each approved recovery could make the next request easier to argue.
Two questions stay open. How much stake will upgrade before the activation block, and will future hack victims cite this fork as precedent? Node operators will need the new release before activation. An outdated node could end up on the wrong side of a split.
For now, the tokens sit frozen where the attackers left them. The governance call starts the approval clock, and no mainnet activation block or client release has been set.
