Hacker doesn't hand over private key, so Polygon just directly changes the balance? The 70.49 million POL recovery plan sparks governance controversy.

Polygon has formally proposed a protocol improvement proposal (PIP) that would use a network-coordinated hard fork to zero out roughly 70.49 million POL tokens held in five attacker-controlled addresses tied to the Polymarket and Binance security incidents and transfer the full amount to victim-designated recovery wallets. The balances comprise about 23.86 million POL across four Polymarket-linked addresses and about 46.63 million POL in one Binance-linked address, with the state rewrite confined to those five addresses and the total POL supply held constant. The move follows an October 29-30 exploit in which validators deployed temporary Bor client blacklists that could block outbound transfers but could not strip attackers of private-key signing control or return funds to victims. The proposal deliberately narrows its intervention to the current state slice rather than rolling back historical blocks, echoing the 2016 Ethereum DAO hard fork debate over "code is law" while framing the action as an exceptional remedy for rare security disasters. Polymarket and Binance were scheduled to defend the proposal at Polygon's governance call on November 5 at 14:30 UTC, after which core developers and validators would need to approve it. If approved, engineers expect about two weeks to patch the Bor and Heimdall clients, with sandbox validation on the Amoy testnet before a mainnet hard fork block height is announced.