Polygon's governance forum received a proposal on November 4 to hard-fork the Polygon PoS network and forcibly reassign 70.49 million POL tokens — worth approximately $6.8 million — from five attacker-controlled addresses back to Binance and Polymarket. The tokens were stolen in two separate inci...
"This is an exceptional remedy under extremely low-probability security disasters and cannot serve as precedent for routine disputes." — Parvez03, Polygon Labs Validator Support Team
Polygon's governance forum received a proposal on November 4 to hard-fork the Polygon PoS network and forcibly reassign 70.49 million POL tokens — worth approximately $6.8 million — from five attacker-controlled addresses back to Binance and Polymarket. The tokens were stolen in two separate incidents on October 29-30. Polygon block producers have already frozen the affected addresses, preventing further movement of the stolen funds.
The proposal, co-drafted by Binance and Polymarket and published by Polygon Labs' Validator Support Team member Parvez03, is scheduled for discussion at the Polygon Protocol Governance Call on November 5 at 14:30 UTC. If approved by the Core Dev Committee and the 105-member validator set, engineering teams would develop client patches within approximately two weeks, followed by testing on the Amoy testnet before mainnet deployment.
This is the most consequential governance intervention on a major proof-of-stake network since the Ethereum DAO fork in 2016. The economic stakes are relatively small — $6.8 million against Polygon's $1.02 billion market cap — but the governance precedent is not.
Two separate security breaches on October 29-30, 2026, deposited stolen funds into Polygon PoS addresses.
Binance — $4.51 million (46.63 million POL)
On October 29, an attacker drained Binance hot wallets across ten blockchains in under four hours, stealing $6.3 billion total — the largest theft in cryptocurrency history. The attacker gained access to Binance's hot-wallet signing system, deploying a sweeper contract at 15:59 UTC and executing the drain starting at 20:04 UTC. According to the FBI, the breach has been tied to North Korean hackers associated with the TraderTraitor group. Of the total haul, 46.63 million POL and 6.19 million USDT were transferred from a Binance hot wallet to a single attacker-controlled address on Polygon PoS.
Polymarket — $2.31 million (23.86 million POL)
On the same day, attackers compromised DebugBear's DNS records through its domain registrar and swapped Polymarket's real user monitoring script for a wallet drainer. Within 52 minutes, approximately $2.73 million was swept from 737 wallets. The attack was a supply-chain compromise: the DebugBear performance-monitoring script loaded by Polymarket's browser client was replaced with a 15 KB drainer that, acting as the logged-in visitor, sold positions and moved tokens. Polymarket's US platform was not affected. Polymarket halted international trading, resumed within an hour, and subsequently refunded approximately $3.9 million to affected and indirectly impacted traders. Of the stolen assets, 23.86 million POL were moved to four attacker-controlled addresses on Polygon.
In total, 70.49 million POL sits in five addresses that Polygon block producers have already frozen via transaction block lists.
The proposal does not rewrite Polygon's transaction history. Instead, it introduces a one-time balance adjustment at a predetermined block. At the designated block height, before any other transactions are processed, the network would:
Total POL supply remains unchanged at 10.64 billion tokens. No new tokens are minted. No historical transactions are erased. The adjustment modifies only the current state snapshot — the latest account balances — not the chain's history.
Node operators who do not install the updated client software would continue on an incompatible chain, creating a potential chain split. This is the standard risk inherent in any hard fork.
The proposal lays out specific activation requirements:
Following approval, Polygon engineering estimates approximately two weeks of development time. The patch must pass testing on the Amoy testnet before a mainnet activation block is selected. No activation block or client release has been selected as of November 5.
Polygon PoS operates with a capped validator set of 105 nodes. The relatively concentrated validator set means coordination costs for a hard fork are materially lower than for networks with thousands of validators. All 105 validators must upgrade their client software to follow the fork chain; there is no partial opt-in.
The proposal explicitly describes itself as an "extreme measure that should not be reproduced commonly." The comparison to Ethereum's 2016 DAO fork is unavoidable.
On July 20, 2016, Ethereum executed a hard fork at block 1,920,000, rolling back the network state to recover approximately 3.6 million ether — then worth roughly $50 million — stolen from The DAO smart contract. Approximately 85-89% of voters supported the fork. The remaining minority continued mining the original chain, creating Ethereum Classic (ETC).
Key differences between the two situations:
| Factor | Ethereum DAO Fork (2016) | Polygon Proposal (2026) | |--------|-------------------------|------------------------| | Amount at stake | ~$50 million (3.6M ETH) | ~$6.8 million (70.49M POL) | | % of market cap | ~5% of ETH market cap at the time | ~0.67% of POL's $1.02B cap | | Network type | Proof-of-work | Proof-of-stake | | Validator/miner count | Thousands of miners | 105 validators | | Mechanism | State rollback (irregular state change) | Balance adjustment (current state only) | | Chain split result | Created Ethereum Classic | Unknown; risk exists |
The DAO fork established a precedent that extra-protocol social consensus can override "code is law" to reverse catastrophic outcomes. Ethereum's leadership stated at the time that this would not recur — "no future bailouts." That position has largely held for Ethereum itself over the subsequent decade.
In 2022, Binance Smart Chain (now BNB Chain) coordinated a temporary chain halt and rollback after a $568 million bridge exploit, though that network's highly centralized validator structure (21 validators) made the action less controversial.
The direct economic calculus is straightforward. Binance recovers $4.51 million in POL. Polymarket recovers $2.31 million. Both amounts are marginal relative to the entities involved — Binance absorbed the full $6.3 billion hack from its SAFU fund and company reserves; Polymarket already refunded $3.9 million to affected users.
The question is whether the recovery justifies the governance cost. The $6.8 million at stake represents 0.67% of POL's market capitalization. The fork's true cost is measured in precedent, not tokens.
For Polygon's 105 validators, the operational burden is a client software upgrade. The coordination cost is low relative to decentralized networks with thousands of nodes. But the governance cost — the signal that Polygon's state can be modified by validator consensus under certain conditions — persists indefinitely.
From an economic value distribution perspective, the fork redirects value from attacker addresses to victim recovery wallets. No value is created or destroyed. The total supply is unchanged. But the fork does impose an externality: every POL holder's implicit contract with the network now includes the possibility that balance adjustments can be made via governance under extraordinary circumstances.
The proposal attempts to thread a narrow needle. Its architects describe the mechanism as targeting "the current latest state snapshot" rather than rewriting confirmed transaction history. This is a technically accurate distinction — no blocks are reversed, no transactions are deleted — but the practical effect is the same: funds move from address A to address B by governance fiat rather than by private key authorization.
The crypto industry has been debating this trade-off since 2016, and no consensus has emerged. The arguments map to well-established positions:
In favor of the fork:
Against the fork:
The proposal's own language — "exceptional remedy" that "cannot serve as precedent for routine disputes" — acknowledges the tension but cannot resolve it. Precedent, once set, is defined by observers, not by the entity that sets it.
Polygon's hard-fork proposal tests a governance framework that most proof-of-stake networks have theorized about but few have invoked. The facts favor intervention: the funds are verifiably stolen, the attacker addresses are identified, the amounts are precise, and law enforcement has attributed the larger Binance breach to North Korean state actors.
But the precedent extends beyond the facts of this case. A network that can modify balances by validator vote — even under strict conditions — operates under a different trust model than one that cannot. Polygon's 105-node validator set makes the fork mechanically simple to execute, which is precisely what makes the governance implications complex.
The Protocol Governance Call on November 5 at 14:30 UTC will determine whether Polygon's validators treat state finality as absolute or conditional. Either answer carries costs. The data suggests the fork will proceed — the affected parties co-drafted the proposal, Polygon Labs staff published it, and block producers have already frozen the addresses. The question is not whether Polygon can execute a state adjustment. The question is what it means for every other network watching.