Original ｜Odaily Planet Daily (@OdailyChina)

Author｜Golem (@web3_golem)

If hackers steal assets that have been frozen on-chain but still refuse to return them voluntarily, is it necessary to directly tamper with the hacker's address balance through a hard fork? Tonight, Polygon will confront this question.

On November 5, Polymarket and Binance submitted a hard fork proposal to Polygon, which aims to hard fork the Polygon PoS mainnet to zero out approximately 70.49 million POL (worth 6.7 million USD) in the hacker's attack address and directly credit the equivalent balance to the recovery addresses designated by Polymarket and Binance. The hacker's assets would vanish into thin air, while Polymarket and Binance's addresses would gain an additional asset, but with a decrease and increase completing the settlement, the total supply of POL remains unchanged.

This proposal can be traced back to two nearly simultaneous security incidents. On October 30, the Polymarket frontend and Binance hot wallet were breached by hackers, prompting a swift response from Polygon validators, who froze four Polymarket hacker addresses (involving 23.86 million POL) and one Binance hacker address (involving 46.63 million POL), effectively stopping the hackers from transferring the stolen assets.

While freezing assets is relatively easy, recovering them remains challenging. Polymarket sought cooperation from the hackers but received no response. According to the proposal, the hackers even contacted Polygon validators, proposing a cash reward in exchange for unfreezing the addresses.

To avoid destabilizing the validators, Polymarket and Binance proposed this hard fork proposal together. On November 5 at 22:30 Beijing time, the Polymarket and Binance teams will present their case at the Polygon Protocol Governance Committee (PPGC) meeting. What choice will the Polygon community make then—to help Polymarket and Binance combat theft or to uphold the immutability of the chain and their own decentralized reputation?

Will Polygon compromise its reputation to clean up after Polymarket and Binance?

As of the time of publication, while Polygon officials, PPGC members, and Polygon core developers have not publicly stated their position on this proposal, the likelihood of it passing is actually quite low.

In the cryptocurrency industry, whenever a security incident occurs with a project, it has become a consensus among stakeholders to help freeze the assets stolen by hackers and jointly protect users. However, directly altering on-chain address balances to help project parties recover assets is unprecedented in such “cleanup” actions.

Freezing assets and moving funds without keys are two completely different concepts. The former, while involving centralized intervention, still restricts trading permissions on specific addresses under existing rules without changing the actual ownership of the assets; the latter means that even without private key signatures, the protocol can directly zero out the balance of a specific address and transfer it to another address. This severely violates two basic principles of the cryptocurrency industry: on-chain data is immutable and “Not your keys, not your coins.”

If Polygon can bypass private key control to transfer assets from an address deemed a hacker's address through governance procedures, will users' assets be similarly zeroed out tomorrow? The trust in blockchain is not only built on how rules are described, but more importantly, whether those rules can be broken. Once this precedent is set, other projects will have reason to request Polygon to handle their security incidents in the same way.

Polymarket and Binance emphasized in the proposal that this operation targets only the specific addresses involved in the two security incidents and should not become a routine operation, nor does it imply that Polygon will establish a universally applicable mechanism for asset freezing and recovery.

However, from a realistic perspective, Polygon has no obligation to clean up after their security incidents, especially considering that Polygon’s cost is still its decentralized reputation, and the risks it assumes do not equate to the actual benefits.

The assets proposed for recovery amount to approximately 70.49 million POL, with a total value of about 6.5 million USD. For Polymarket and Binance, both large-scale industry participants, this is not an unbearable loss, especially since both have already fully compensated users out of their own pockets. This hard fork proposal is merely an attempt to leverage their industry influence or resources to request Polygon to help recover some losses.

But what can Polygon actually gain from this hard fork? Helping two ecological partners recover assets may lead to maintaining certain relationships and goodwill within their communities, but this cannot directly translate into Polygon’s network revenue, user growth, or ecological competitiveness. On the contrary, once the hard fork is implemented, the questioning Polygon will face will be whether it is still a decentralized network worth trusting.

Therefore, considering the long-term trade-off between reputation and interests, this proposal is likely to fall through.

Historical precedents of tampering

Historically, there have been cases where balances in hacker addresses were directly intervened through hard forks to recover stolen funds. The most classic example is the Ethereum The DAO incident.

In 2016, The DAO smart contract was exploited, with hackers stealing about 3.6 million ETH, valued at over 50 million USD at the time, accounting for approximately 14% of the total ETH supply at that time. The Ethereum community ultimately decided to execute a hard fork to transfer the hacker's address balance out and into a refund contract, ultimately returning funds to investors.

However, the cost was that this hard fork led to a serious community split, with opponents choosing to maintain the original chain, giving rise to Ethereum Classic (ETC). This event is still regarded as a landmark event in blockchain governance and is a classic debate case between “Code is law” and “social consensus can intervene in the network.”

A more recent example is Core Network. On October 31, approximately 97 million CORE staked via the b14g protocol were withdrawn without authorization and transferred to an address controlled by hackers. On November 2, Core Network announced it would execute a hard fork to recover 68,146,177.22 CORE from three addresses controlled by attackers, accounting for approximately 70.2% of the affected CORE from the October 31 incident. The recovery method is quite similar to the proposal Polymarket and Binance made to Polygon.

While both of these hard forks were successful, they occurred under circumstances where the project parties were unable to backstop and where the impact on the network was significant, which is starkly different from the situation Polygon is facing. Polymarket and Binance are fully capable of covering the users' losses (and have already done so), and 70.49 million POL accounts for less than 1% of POL's circulation; even if the hackers sold all of it, there would be little substantial impact on the price of Polygon, staking, Gas fees, or the overall ecosystem.

However, considering the friendly relationship between Polymarket and Polygon, along with the influence of the large platform Binance, it is also possible that Polygon would make an exception for them.

Ultimately, will Polygon choose to "do what is right" or uphold its decentralized reputation? The answer will be revealed tonight.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。