Polygon's proposed recovery of roughly 70 million POL would move coins out of five hack-linked wallets without their holders signing a transfer. The plan would change balances through the network's rules, putting the authority to return stolen funds in the hands of governance and validators.
The November 4 proposal targets five addresses it links to stolen funds from security incidents affecting prediction market Polymarket and exchange Binance. Its dated reference tables attribute about 24 million POL to four Polymarket-linked addresses and 47 million POL to one Binance-linked address. The actual recovery would use balances at activation, not these dated reference amounts.
As of November 9, the published proposal still leaves the recovery fork's name, client release and activation block undecided. The November 5 governance agenda lists the proposal for discussion without recording approval. The separate Bor v2.11.0 release implements Uburu's StateReceiver changes, rather than this proposed recovery.
Who can authorize Polygon’s recovery?
Under the proposed design, the upgraded software would read each listed address's balance immediately before activation, set it to zero and credit the same amount to the designated recovery address. This would happen before transactions execute in the activation block. Total supply would stay the same, and earlier chain history would remain intact. The proposal says Bor engineering must still confirm the design.
That would place recovery authority in a combination of governance approval, the specified address list and the software rule validators adopt. The affected companies would designate the recipients. Polygon Labs would confirm the proposed proof of recipient control. The proposed sweep would not require a transaction signed by the source addresses.
Those are separate responsibilities. Tracing stolen coins to an address supports the case for including it; proving control of a recovery address checks where the coins would go. The proposal itself warns that misidentifying an attacker-controlled address could move a legitimate balance.
Its recipient-verification requirements call for proof of control, such as a signed message or small test transfer confirmed by Polygon Labs, plus written confirmation that the address belongs to the recipient. The proposal also excludes other tokens and a separate category of blocked addresses, limiting the proposed sweep to native POL at the five listed accounts.
The full-balance rule creates another ownership question: later deposits would move too. The proposal requires balances to be checked again before activation and any changes to be published.
Those checks would disclose which coins the sweep includes, but would not establish that every later deposit belonged to an incident victim.
A recovery that accounting systems can see
For exchanges and custodians, the proposed movement would create a difference between the balance shown by an upgraded node and the balance reconstructed solely from ordinary transactions. The proposal explicitly flags this problem for explorers, indexers and accounting tools.
A reconciliation would therefore need to connect each affected source address, its balance before activation, the designated recipient and the corresponding credit at the activation block. For custodians, the rule implies a separate balance adjustment, since there would be no ordinary transfer transaction to match against it.
The planned checks address part of that burden: an Amoy rehearsal would test that supply stays constant and unrelated accounts remain unchanged, followed by a mainnet-fork replay. The proposal also calls for publishing the transaction-free balance change and a verification script after activation. Together, those records would let operators compare the implemented change with the approved scope.
Customer reimbursement is a separate process. In its October 30 postmortem, Polymarket said 95% of affected wallets had been refunded in full that afternoon and announced $4 million being returned, including $1 million for pause-related losses. Those refunds compensate traders; the proposed fork would return assets to company-designated recovery addresses.
The next recovery milestone would require a governance decision, a final software specification, verified recipients and an activation block.
