Polygon Labs floats hard fork to return 70.5M POL frozen on Polymarket, Binance hacker addresses

Polygon Labs has published a Polygon Improvement Proposal (PIP) that would execute a one-off hard fork on Polygon PoS to re-credit 70.49 million POL — currently frozen on five attacker-controlled addresses from the recent Polymarket and Binance incidents — to recovery wallets controlled by the two victims. The proposal, titled Recovery of Funds Held in Blocked Addresses following the Polymarket and Binance Incidents, was posted by Parvez03 on November 4 at 17:08 UTC. A presentation at the Polygon Protocol Governance Call (PPGC-47) is on the agenda for November 5 at 14:30 UTC; the PIP's final vote date and PIP number are not yet set.

What happened

On October 30, four Polygon PoS block producers (anonymous-91 through anonymous-94) added five attacker addresses to the blocklist of Bor, Polygon's execution client, at Binance's request. That freeze stops the attackers from moving the stolen POL but, as the PIP text states, "the funds cannot move, but nothing in the current setup lets them be returned either." The hard-fork proposal is Polygon Labs' answer to that gap.

The five Class A addresses, with native POL balances read from the PIP:

Polymarket incident (4 addresses, 23,862,736.07 POL total):

• 0xe4C4C39C1733e1C7c06B79f97ED442B68Df41EC6 — 15,331,308.29 POL
• 0x5392587814Ce8c6af6789764f88e5e9AB0b9962C — 4,295,442.00 POL
• 0xc91ee0574a14446DE200923729c349B9CAE19b60 — 4,235,982.73 POL
• 0x3f7019221a925537dC20767C38e80A7127fb1Ffa — 3.05 POL

Binance incident (1 address, 46,626,593.27 POL):

• 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c

The PIP cites an indicative USD value of $6.5M at $0.0924 / POL. The 6.19M USDT also sitting on the Binance address is excluded — Tether has already frozen it at the contract level.

Mechanism

At a fixed activation block F, the Bor hard fork sets the native POL balance of each Class A address to zero and credits the same amount to a verified recovery address:

• Polymarket recovery: 0x3dcE0a29139A851Da1dFCa56Af8e8a6440b4D952
• Binance recovery: 0xd9fd39103674cb061d64d9c3b73b878dbe610b80

Changes are strictly limited to the native POL balances of the five listed addresses. Class B addresses (unrelated but adjacent) are not touched. Heimdall, the StakeManager, and bridge contracts are unchanged. Total POL supply is unchanged. The PIP text flags that the exact implementation is "to be confirmed by Bor engineering."

Conditions and precedent

The PIP lays out six preconditions it says must all hold before Polygon governance should consider this kind of action:

1. The theft is publicly acknowledged by the victim.
2. All block producers have blocked the addresses.
3. The sum is significant.
4. Funds trace to the victims.
5. The affected parties formally request the remedy.
6. No party has contested the account.

The abstract frames the proposal explicitly as an outlier: "It is an extreme action that should not be reproduced commonly." The closest Ethereum-era precedent remains the DAO fork of July 2016, which transferred ETH out of the attacker's contract at block 1,920,000 and split the chain into Ethereum and Ethereum Classic. Polygon Labs is pre-empting that comparison by describing the mechanism as a closed list of five addresses tied to two specific incidents — not a general freeze-and-return primitive.

Numbers block

- Polymarket incident addresses              : 4
- POL on Polymarket addresses                : 23,862,736.07
- Binance incident addresses                 : 1
- POL on Binance address                     : 46,626,593.27
- Combined POL                               : 70,489,329.34
- Indicative USD value (at $0.0924 / POL)    : $6.51M
- USDT on Binance address (excluded, frozen) : 6.19M USDT
- Existing Bor blocklist in force since      : 30 October 2026
- Governance presentation                    : 5 Nov 2026, 14:30 UTC
- Claimed timeline                           : 1 week "tight", 2 weeks "realistic"

Risks and operational notes

The PIP flags three operational hazards:

1. Recovery-address correctness. Polymarket and Binance must prove they control their destination addresses before activation; a wrong address is irreversible.
2. Chain split. Validators, RPC providers and node operators that don't upgrade would stay on a chain where the stolen funds remain. The PIP calls for coordinated signalling across block producers, bridge operators and explorers before the activation block is published.
3. Attacker counter-measures. Per the thread, attackers have been bidding priority fees as high as 219,450 POL to get transactions included and have reportedly approached validators with cash offers. The fork proposal is in part a response to those escalating attempts.

On-chain integrators have already asked on the thread for (a) the activation block published in advance and (b) a machine-readable list of addresses — williamsj043, Nov 5. A separate commenter, S1W, raises the precedent concern explicitly: that even a tightly-scoped fork creates expectations of future freeze-and-return requests.

What to watch

1. The PPGC-47 vote today. Polygon validator turnout and whether the Labs team gets a clean mandate or requests for revisions on recovery-address custody.
2. A machine-readable address list and activation block publication before the dress rehearsal on Amoy testnet.
3. Any on-chain contest from a third party claiming an interest in the Class A balances (none reported at time of posting).
4. Binance and Polymarket published statements confirming they control the two recovery addresses listed in the PIP.
5. The signalling from large RPC providers and block explorers (Infura-equivalent, Alchemy, QuickNode, Polygonscan) on whether they will track the forked chain.

Context

This is the first time Polygon's governance process is being asked to approve a balance-level hard fork since the PoS chain launched. Polygon's recent forks — Lisovo (March 2026), Giugliano (April 2026), and the June 25 execution client bump — were all protocol-level upgrades, not state surgery. The direct precedent remains Ethereum's DAO fork (block 1,920,000, July 20 2016), which is also the source of nine years of legal and philosophical argument about whether a general-purpose chain should ever rewrite state. Polygon Labs' answer with this PIP is a narrow one: yes, in this closed set of five addresses tied to two public thefts, once; no, not as a repeatable primitive. The vote this afternoon is what decides whether that framing holds.