Binance and Polymarket are backing a Polygon governance proposal that would hard fork the network to move about 70.49 million POL out of five attacker-controlled addresses and into recovery wallets. The proposal values those tokens indicatively at $6.5 million, at $0.0924 per POL, the spot price on 29 October 2026.

The Polygon Improvement Proposal (PIP) was posted to the community forum on 4 November 2026 and is scheduled for discussion at the Polygon Protocol Governance Call today, 5 November, at 14:30 UTC. There is no confirmed date for the mainnet fork.

Key Facts

  • About 70.49 million POL sits in five blocked addresses: roughly 23.86 million POL across four addresses from the Polymarket incident and about 46.63 million POL in one address from the Binance incident.
  • The proposal would move the tokens to recovery wallets at a predetermined block without changing POL's total supply.
  • Polygon block producers already block transfers from the affected addresses, but the proposal calls that a temporary measure that cannot return the funds to their owners.
  • After approval, client development and an Amoy testnet rehearsal are seen as taking about two weeks, with one week described as tight.

The Fork Moves Tokens, It Does Not Mint Them

Here is the mechanism in plain terms. At a set block, the fork would strip the stolen POL from the five addresses and credit it to two wallets the two companies designated: Polymarket's at 0x3dcE0a29139A851Da1dFCa56Af8e8a6440b4D952 and Binance's at 0xd9fd39103674cb061d64d9c3b73b878dbe610b80.

POL's supply stays the same. The tokens are redirected, not replaced, so holders are not diluted by the recovery.

Two Incidents, Both on 29 October

Polymarket's side traces back to 29 October 2026, when about 28 million POL was involved on Polygon PoS. The record shows 3,282,275.71 POL moving from 0xe4C4…1EC6 to 0x3f70…1Ffa in two native transfers at 18:30:34 and 18:35:59 UTC. The largest blocked address, 0xe4C4C39C1733e1C7c06B79f97ED442B68Df41EC6, still holds 15,331,308.29 POL and was the source of the onward transfers.

Polymarket's own postmortem says a third-party vendor whose performance-monitoring script loaded on polymarket.com was compromised, and the attacker replaced that script with one built to target Polymarket users, using active sessions to sell positions and move funds out of wallets. The company said it referred the case to law enforcement and paused trading and its relayer to stop further drains. Polymarket says it is returning $3.9 million to traders in total: $2.7 million drained plus $1.2 million to cover losses tied to the pause.

On the Binance side, the exchange was hacked late on 29 October 2026 and asked all validator-elected block producers on 30 October to block address 0x5227…2f8c.

Why Blocking the Addresses Was Not Enough

The block producers' block list did stop the funds from moving, and the proposal says no bypass has been found. But it is a stopgap with an awkward shape: each block producer reads its list only at startup, so every change needs a deployment and a Bor restart or span rotation, and entries carry no automatic expiry.

The attacker has kept pushing. A pending transaction paying a fee of about 219,450 POL (10.45 POL per gas) was observed on 30 October, and the attacker has contacted validators offering cash in exchange for help unblocking a transaction. Polymarket separately opened an on-chain recovery channel to the attacker through the SEAL Safe Harbor Recovery safe and received no response.

What Has to Happen Before the Fork Activates

The fork only fires if several conditions hold at the final vote and at the Amoy sign-off: the PIP is approved through Polygon governance, the presenters' postmortems stay published and consistent with the on-chain record, the block lists on all block producers remain in force until activation, and the Class A balances are re-read at the snapshot block, with any change published.

The proposal also rejected adding a general freeze-and-recover mechanism to the protocol, calling it a permanent power over user funds. This recovery is framed as a one-off, tied to a specific snapshot, rather than a standing tool for future hacks.

The next checkpoint is today's governance call. Approval there starts the clock on client work and a testnet rehearsal measured in weeks, not days, so the earliest realistic mainnet activation sits well after the discussion. Until then, the funds sit where they are: blocked from moving, but not yet returned.