In light of recent security breaches involving Binance and Polymarket, Polygon Labs has proposed a hard fork aimed at recovering roughly 70.49 million POL tokens, which equates to an estimated value of $6.5 million.
summary
In a proactive response to the incidents, a member of Polygon Labs’ Validator Support Team, known as Parvez03, suggested a coordinated hard fork of the Polygon Proof-of-Stake network. This initiative plans to facilitate the return of stolen tokens to wallets owned by the affected entities.
Specifically, the proposal targets 23.86 million POL connected to Polymarket and 46.63 million POL associated with Binance. The overall recovery amount remains within the limits set after the Polygon block creators restricted transactions from five identified addresses.
The hard fork proposal will be addressed at the Polygon Protocol Governance Call on November 5th, where stakeholders will determine its implementation.
Proposed Hard Fork to Recover $6.5 Million in Stolen POL
The suggested network upgrade focuses on transferring stolen POL from the blocked addresses to a designated recovery wallet controlled by Binance and Polymarket. The plan identifies the following amounts: 23.86 million POL linked to Polymarket across four addresses, and an additional 46.63 million POL from a Binance-linked address.
Using POL’s price of $0.0924 as of October 29, the total recovery amount is approximately $6.5 million.
Under the proposed changes, the balances will be removed from the specified addresses and deposited into secure wallets owned by the affected institutions. This method does not involve creating any additional POL tokens, maintaining the total supply of the cryptocurrency.
During the transfer process, developers will ensure that these transactions occur within a specific block before any other transactions are processed.
The proposal characterizes this intervention as an “extreme act that should not generally be replicated.” The authors claim that recovering funds from wallets controlled by attackers without knowledge of their private keys necessitates amendments to the operational rules of the blockchain.
Background on Binance and Polymarket Security Incidents
The recovery initiative arises from two separate incidents reported on October 29th and 30th. The first incident concerning Polymarket involved approximately 28 million POL, while the planned recovery specifically addresses the identified balances in the blocked wallets.
Following the breach, Polymarket had temporarily halted trading and has since resumed operations, assuring affected users of compensation. On the other hand, Binance experienced fraud-related withdrawals across its multiple blockchains, with attackers transferring approximately 46.63 million POL and 6.19 million USDT from its hot wallet.
Tether intervened by freezing the USDT, and Polygon’s block creators have since restricted transactions tied to the stolen POL. According to Binance’s assessment, the breach impacted around $6.3 billion in assets.
The proposed recovery focuses solely on the identified native POL balances and notably does not account for the full extent of assets affected by the breaches.
Rationale for Modifying Existing Wallet Restrictions
In response to the attack, all four Polygon block creators implemented a transaction blocklist of the identified addresses. While these restrictions prevent further transfers, they also hinder returning assets to rightful owners.
The current practices mandate block producers to reboot their systems or implement other operational changes whenever the list is updated. The proposal indicates that attempts by the attacker to initiate further transactions occurred on October 30th, with an offered transaction fee of approximately 219,450 POL.
The attackers even allegedly reached out to validators, suggesting financial incentives for assistance in transferring the stolen funds, while Polymarket tried unsuccessfully to contact them through recovery channels.
Consequently, the proposal advocates for effecting a one-time protocol change to facilitate the recovery of identified balances instead of maintaining indefinite restrictions.
The proposal warns that granting permanent authority to transfer user funds may raise concerns about asset control on the blockchain, which led to the rejection of a proposal for a common recovery mechanism.
Upcoming Review of the Recovery Plan
The proposed hard fork’s details will be discussed during the Polygon Protocol Governance Call on November 5th at 14:30 UTC. If approved, developers will be tasked with preparing client updates and conducting testing for balance transfers on Polygon’s Amoy test network.
The implementation phase is projected to take about two weeks post-approval, contingent on Binance and Polymarket providing proof of control over the designated recovery wallets and confirmation of the addresses in writing.
Validators, exchanges, infrastructure providers, and other node operators will need to adopt compatible software prior to the activation of the chosen block. Nodes that forego this upgrade risk continued operation on an incompatible version of the blockchain, creating the potential for chain-splitting.
To ensure a smooth activation, the proposal outlines necessary conditions, including governance approval, ongoing enforcement of the blocklist, consistent incident reporting, and final evaluation of affected balances. Importantly, there will be no alteration to existing contracts or previously recorded blockchain transactions within Polygon.
In conclusion, the proposed recovery strategy not only aims to mitigate the impacts of the security breaches but also seeks to uphold the integrity of the network and reinforce user trust in Polygon’s governance mechanisms moving forward.
