Polygon Evaluates Recovery Plan for $6.5 Million Lost in Binance and Polymarket Hacks

Polygon's Proposal for Token Recovery

Polygon is currently evaluating a significant proposal aimed at recovering approximately 70.49 million POL tokens, valued at around $6.5 million, which were lost due to security breaches involving both Binance and Polymarket. On November 4, a member of the Validator Support Team at Polygon Labs, known as Parvez03, put forward a suggestion for a coordinated hard fork of the Polygon Proof-of-Stake (PoS) network. This proposed fork is intended to enable the recovery of stolen tokens by reallocating them to verified wallets belonging to the affected organizations.

Details of the Theft

The theft is divided between two incidents: around 23.86 million POL is associated with Polymarket, while Binance has about 46.63 million POL involved. These cryptocurrencies have been frozen due to Polygon’s block producers implementing transaction restrictions on five addresses identified in relation to the breaches. The formal discussion regarding this recovery plan is scheduled for the Polygon Protocol Governance Call happening on November 5.

Proposed Recovery Mechanism

Under the proposal, a hard fork would facilitate the reallocation of the stolen POL from the blocked addresses to designated recovery wallets controlled by Binance and Polymarket. The stolen POL amounts were based on the POL price of $0.0924 as of October 29. Importantly, the proposal ensures that no new POL tokens will be minted, and the overall supply of the cryptocurrency will remain unchanged.

The intended transfers would take place at a specific block in the network’s history while halting other transactions temporarily at that moment. The proposal highlights the seriousness of this action, labeling it as an "extreme measure" that should not be taken lightly or on a regular basis. Its author emphasizes that recovering assets from wallets under the control of attackers necessitates modifications to current blockchain protocols.

Background of Security Incidents

This recovery initiative comes in the wake of two notable security incidents reported on October 29 and 30. During the Polymarket incident, approximately 28 million POL was reported as involved, even though only the balances from four specific blacklisted wallets are considered for recovery. Following the breach, Polymarket temporarily suspended trading as a precaution after a third-party service provider faced a compromise, later resuming operations and offering compensation to affected users.

In a separate event, Binance disclosed significant unauthorized withdrawals from its hot wallets, including the transfer of 46.63 million POL and 6.19 million USDT to an address controlled by an unauthorized party. While Tether froze the USDT involved in the withdrawal, Polygon's block producers promptly restricted transactions linked to the stolen POL. The overall financial impact of the Binance breach was assessed to be around $6.3 billion, illustrating the substantial scale of these breaches.

Challenges and Considerations

The recovery proposal specifically addresses only the identified POL amounts and not the full extent of losses incurred by either incident. After the hacks, Polygon block producers flagged the affected addresses in their transaction lists to minimize potential further losses. However, the proposal stresses that merely restricting transactions will not compensate the rightful owners of the assets.

Furthermore, evidence suggests that the attacker had made attempts to transact again on October 30, offering a substantial fee for a transaction. There were even reports that the attacker reached out to validators to negotiate the movement of the stolen funds. In an effort to resolve the situation, Polymarket reportedly sought communication with the attacker but received no feedback.

Next Steps

The proposal concludes that the transfer of the identified amounts is preferable to leaving them indefinitely blocked, though the suggestion to establish a general recovery mechanism was dismissed. Concerns were raised that this could lead to excessive control over users’ blockchain assets.

As the hard fork proposal heads to the Polygon Protocol Governance Call, expected to start at 14:30 UTC on November 5, it is crucial to secure the approval of network participants. Following this, developers would initiate client updates and trial the balance transfers on the Amoy test network, aiming for completion within two weeks. Control of the recovery wallets would need to be clearly established by Binance and Polymarket, and the protocols to facilitate this recovery must be actively enforced.