TLDR
- A proposed hard fork aims to recover approximately 70.49 million POL tokens valued near $6.5 million from attacker-controlled wallets.
- Two distinct security breaches targeted Polymarket on October 29 and Binance on October 30.
- Current protection measures are described as temporary and vulnerable to sophisticated bypass attempts.
- Hackers attempted both monetary bribes to network validators and exceptionally high transaction fees exceeding 219,000 POL.
- Governance discussion is scheduled for the Polygon Protocol Council meeting on November 5.
The Polygon blockchain community faces a critical decision regarding an emergency hard fork designed to recover approximately 70.49 million POL tokens from five compromised addresses controlled by attackers. These digital assets, currently valued around $6.5 million, were stolen during two separate security incidents affecting Polymarket and Binance during the final days of October.
According to documentation shared by a representative from the Polygon Labs Validator Support Team, existing safeguards protecting the stolen funds remain insufficient and susceptible to determined attackers who continue attempting to circumvent restrictions.
The first breach occurred on October 29 when Polymarket suffered a compromise through a corrupted third-party vendor script. Attackers exploited this vulnerability to drain approximately 28 million POL from users who were actively logged into trading sessions.
Network validators responded by blocking four wallet addresses connected to this incident, collectively holding roughly 23.86 million POL. Prior to the block, one of these addresses had already transferred 3,282,275.71 POL across two separate transactions.
Shortly after, Binance experienced its own security breach late on October 29 when an engineer’s laptop was compromised. During block 96,406,484, a Binance hot wallet executed an unauthorized transfer of 46,626,589.6 POL alongside 6,185,900.1 USDT to a single attacker-controlled address.
While Tether successfully froze the USDT portion, the POL tokens remain vulnerable and continue residing on the validator blocklist.
Current Protection Measures Prove Inadequate
Following both security incidents, Polygon’s validator-elected block producers implemented a response by adding suspected attacker addresses to Bor’s transaction blocklist. This mechanism has successfully prevented fund movement thus far, with no documented successful bypass.
Nevertheless, the proposal characterizes this blocklist as merely a temporary solution with significant limitations. Block producers only load their lists during initialization, meaning any modifications require full deployment cycles and system restarts. Additionally, no automatic expiration exists for blocklist entries.
The filtering mechanism exclusively covers outer transaction senders and EIP-7702 authorities. According to the technical documentation, this creates gaps that prevent it from functioning as a comprehensive asset freeze.
Attackers have persistently probed the system for vulnerabilities. On October 30, monitoring systems detected a pending transaction offering an extraordinary fee approaching 219,450 POL, translating to approximately 10.45 POL per unit of gas.
Beyond technical attempts, attackers directly contacted validators with offers of cash payments in exchange for assistance unblocking transactions. Meanwhile, Polymarket established an on-chain recovery mechanism through the SEAL Safe Harbor Recovery Safe but has received no communication from the attackers.
Technical Details of the Proposed Fork
The emergency hard fork would execute a forced reset of all blocked addresses to zero balances at a predetermined block height. Simultaneously, equivalent amounts would be credited to verified recovery wallets designated by Polymarket and Binance.
This operation would maintain POL’s total circulating supply unchanged. Critical infrastructure including Heimdall, the StakeManager, and bridge contracts would remain unaffected by the modifications, according to technical specifications.
Both Polymarket and Binance must demonstrate cryptographic control over their designated recovery addresses before activation proceeds. Verification methods include cryptographically signed messages or confirmed small test transactions witnessed by Polygon Labs.
The proposal explicitly rejects developing a permanent freeze-and-recover mechanism, characterizing such a tool as excessive authority over user assets. The document emphasizes this fork represents an exceptional response that should not establish a precedent for routine application.
Successful implementation requires all validators, RPC providers, cryptocurrency exchanges, and independent node operators to upgrade their Bor client software before the designated activation block. Any nodes failing to upgrade would diverge onto an alternative chain fork.
Polygon validator operations teams anticipate approximately 70% to 80% of staked value will achieve the required software version shortly following release. Additional Binance addresses categorized as Class B would remain untouched by the fork modifications.
The proposal enters formal review during the Polygon Protocol Governance Call scheduled for November 5 at 14:30 UTC. Upon approval, development teams estimate approximately two weeks for client development and comprehensive testing on the Amoy testnet environment.
