Hacks on Polymarket and Binance Trigger Network Restrictions

On October 29 and 30, 2026, two separate security events affected the platforms and routed stolen POL to addresses on the Polygon Proof-of-Stake network. Polymarket suffered an incident involving a compromised third-party provider that led to unauthorized withdrawals from active trading sessions. Binance reported unauthorized activity tied to a compromised engineer’s laptop, resulting in hot wallet transfers to an attacker-controlled address.

Polygon block producers responded by adding the affected addresses to transaction blocklists. This halted outgoing movements from the five wallets, which collectively hold 23.86 million POL linked to Polymarket and 46.63 million POL tied to Binance. The restrictions prevented further transfers but did not restore ownership or provide a recovery path. Separate incidents also saw Tether freeze associated USDT assets and Polymarket activate an on-chain recovery channel through its SEAL Safe Harbor Recovery Safe, with no reported response from the attacker.

Reports indicate the attacker made one attempt to push a pending transaction by offering roughly 219,450 POL in fees and allegedly contacted validators about cash payments to lift restrictions.

Governance Proposal Seeks Coordinated State Change

A Polygon Labs validator support team member submitted a Polygon Improvement Proposal requesting a one-time hard fork. The upgrade would remove balances from the five blocked addresses and credit them to designated recovery wallets controlled by Polymarket and Binance. No additional POL would be created, preserving the network’s total supply.

The transfers would execute at a predetermined block height, executed before other transactions at that point. Developers estimate client updates, Amoy testnet rehearsals, and final preparations could be completed within approximately two weeks if approved. Validators, exchanges, and node operators would need to upgrade their Bor clients before activation. Any that fail to comply would follow a different chain version from that block onward.

The proposal explicitly describes the action as an “extreme action that should not be reproduced commonly.” It would affect only the identified addresses rather than establishing a general mechanism for moving funds. Other core components, including Heimdall, StakeManager, and bridge contracts, would remain unchanged. Blockchain explorers, indexers, and accounting tools would need to recognize the adjusted balances, as the change would not appear through ordinary transaction history.

Governance Discussion Set for November 5

Approval requires confirmation of control over the recovery wallets and written address verification by Binance and Polymarket. Once approved, the block producers would enforce the blocklists until activation. The proposal includes safeguards such as continued enforcement and a final balance review. No activation block or exact client release has been set.

The change would require all participants to upgrade in advance, with advanced notice provided. It would also trigger a review of the affected balances before mainnet activation. The author noted that the intervention raises broader questions about blockchain authority in theft recovery cases while preserving users’ confidence in asset safety.

Broader Implications for Stolen Asset Recovery

Approval of the fork would set a precedent for future incidents involving stolen tokens on Polygon. It would test the network’s ability to intervene in exceptional circumstances without creating permanent mechanisms that could undermine trust. Validators would retain authority to decide on similar requests based on demonstrated control and verification.

The proposal remains subject to governance approval and successful testnet validation. Until then, the five addresses continue to hold the POL under restrictions, with no confirmed timeline for mainnet activation beyond the governance discussion. The move aims to address a gap left by temporary blocklists that stop movement but cannot return ownership.