Polygon is considering a proposal to recover approximately 70 million POL from five wallets tied to security incidents at prediction market Polymarket and exchange Binance. The plan would move the coins without requiring signatures from the wallet holders, instead using a network rule change to alter balances at a specific block.
The November 4 proposal targets five addresses. Its dated reference tables attribute about 24 million POL to four Polymarket-linked addresses and 47 million POL to one Binance-linked address. The actual recovery would use balances at activation, not these dated reference amounts.
How the recovery would work
Under the proposed design, upgraded software would read each listed address’s balance immediately before activation, set it to zero, and credit the same amount to a designated recovery address. This would occur before transactions execute in the activation block. Total supply would remain unchanged, and earlier chain history would stay intact. The proposal notes that Bor engineering must still confirm the design.
The rule would read each listed account’s full balance from the block before activation. The recovery credit has not yet executed. Because the change happens at a single block, custody records would need a separate adjustment.
Governance and verification requirements
Governance approval, recipient-control checks, and Bor engineering confirmation are required. As of November 9, the proposal still leaves the recovery fork’s name, client release, and activation block undecided. The November 5 governance agenda lists the proposal for discussion without recording approval. The separate Bor v2.11.0 release implements Uburu’s StateReceiver changes, not this proposed recovery.
Recovery authority would rest with a combination of governance approval, the specified address list, and the software rule validators adopt. The affected companies would designate the recipients. Polygon Labs would confirm the proposed proof of recipient control. The proposed sweep would not require a transaction signed by the source addresses.
Tracing stolen coins to an address supports including it, while proving control of a recovery address checks where the coins would go. The proposal warns that misidentifying an attacker-controlled address could move a legitimate balance. Its recipient-verification requirements call for proof of control, such as a signed message or small test transfer confirmed by Polygon Labs, plus written confirmation that the address belongs to the recipient. The proposal also excludes other tokens and a separate category of blocked addresses, limiting the sweep to native POL at the five listed accounts.
The full-balance rule creates another ownership question: later deposits would also move. The proposal requires balances to be checked again before activation and any changes to be published. Those checks would disclose which coins the sweep includes, but would not establish that every later deposit belonged to an incident victim.
Accounting and reconciliation implications
For exchanges and custodians, the proposed movement would create a difference between the balance shown by an upgraded node and the balance reconstructed solely from ordinary transactions. The proposal explicitly flags this problem for explorers, indexers, and accounting tools.
A reconciliation would need to connect each affected source address, its balance before activation, the designated recipient, and the corresponding credit at the activation block. For custodians, the rule implies a separate balance adjustment, since there would be no ordinary transfer transaction to match against it.
The planned checks address part of that burden: an Amoy rehearsal would test that supply stays constant and unrelated accounts remain unchanged, followed by a mainnet-fork replay. The proposal also calls for publishing the transaction-free balance change and a verification script after activation. Together, those records would let operators compare the implemented change with the approved scope.
Customer reimbursement is a separate process. In its October 30 postmortem, Polymarket said 95% of affected wallets had been refunded in full that afternoon and announced $4 million being returned, including $1 million for pause-related losses. Those refunds compensate traders; the proposed fork would return assets to company-designated recovery addresses.
The next recovery milestone would require a governance decision, a final software specification, verified recipients, and an activation block.
