On 29 and 30 October 2026, four block producers of Polygon PoS stopped accepting transactions from five addresses that held about 70.5 million POL taken in the Polymarket and Binance incidents. On 4 November a proposal on Polygon’s forum went further: hard fork the chain and move those balances to recovery addresses chosen by the two victims. As of 12 November 2026 nothing has been decided, and our report on the Polygon recovery proposal gives the details. That it can be proposed at all sums up the sidechain vs rollup question.
The operators of Arbitrum One could not do the same. A group of validators there cannot rewrite a balance on its own, because the contracts on Ethereum that hold the bridged funds check the chain’s claims and accept a challenge from anyone. That gap is the whole debate, seen in one fortnight. A sidechain is a blockchain whose own validators have the last word. A rollup is a blockchain whose last word belongs to Ethereum. Fees, speed and the “layer 2” label matter much less than that.
This lesson takes Polygon PoS, the network most people mean when they say “Polygon”, apart piece by piece, then sets it against Arbitrum One, Gnosis Chain and Ronin, a former sidechain that switched to a rollup framework in May 2026 without yet meeting the bar of the risk tracker ETHBEAT (formerly L2BEAT). Figures are dated: most were read on 12 November 2026.
Sidechain vs rollup: who checks the chain decides who you trust
A short reminder first. A rollup, as set out in our lesson on how layer 2 rollups work, meets three conditions: its transaction data is published on Ethereum, Ethereum verifies its state through a working proof system, and users can leave without anyone’s permission. Optimistic rollups such as Arbitrum prove fraud after the fact; ZK rollups post a validity proof with each batch, the mechanism covered in our guide to ZK rollups and validity proofs.
A sidechain meets none of the three. ethereum.org’s page on sidechains describes it as a separate chain connected to Ethereum by a bridge, and adds: “Each sidechain is responsible for its security and doesn’t inherit Ethereum’s security properties.” It has its own consensus, its own validators and its own data. Ethereum sees only what the bridge contracts are told.
That bridge works by lock and mint. You deposit ETH or USDC into a contract on Ethereum, the sidechain issues a matching token on its side, and on the way back the token is burned and the contract releases the original. Whoever can convince the Ethereum contract that a burn happened can release funds. On a rollup that proof comes from the rollup’s own data and dispute game on Ethereum. On a sidechain it comes from signatures of the sidechain’s validators or of a separate group of bridge signers.
The difference fits in one test, the same one our lesson on Bitcoin layer 2s and sidechains applies to Liquid and Rootstock: if every operator of the chain turned against you tomorrow, could you still get your coins back on the main chain? On a rollup at Stage 1 or above the answer is yes, after a delay. On a sidechain the answer is no. Our comparison of layer 1 and layer 2 already explains why Polygon PoS fails that test; here we go into how its machinery works and what it has done in practice.
Polygon PoS: 100 validators and a checkpoint every 17 minutes
Polygon PoS, first known as Matic Network, took the Polygon name on 9 February 2021, and since 4 September 2024 runs on POL, the token that replaced MATIC for gas and staking, according to the milestones on ETHBEAT’s Polygon PoS page. ETHBEAT describes it as “an EVM-compatible, proof of stake sidechain for Ethereum”. Its structure has three layers.
Ethereum contracts, Heimdall-v2 and Bor
The first layer is a set of contracts on Ethereum mainnet: the staking contracts where validators lock POL, a contract that stores checkpoints, and the bridge. The second is Heimdall-v2, the consensus layer, rebuilt on the Cosmos SDK and CometBFT and live on mainnet since 10 July 2025. Its nodes watch the staking contracts on Ethereum, check the blocks produced on Polygon and sign checkpoints. CometBFT is a descendant of Tendermint, whose two-thirds voting rule is explained in our guide to BFT consensus.
The third layer, Bor, is a fork of Geth, the Ethereum client, and produces the blocks users actually transact on. Since the Rio upgrade of 8 October 2025, Polygon’s architecture documentation says each span of blocks has a single producer, picked by Heimdall from a small smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool of eligible validators. On 12 November 2026 Bor produced a block every 1.50 seconds on average over the last 10,000 blocks, with a gas limit of 160 million per block, according to a read of a public Polygon node.
What a checkpoint tells Ethereum, and what it leaves out
Every so often Heimdall gathers the hashes of a range of Bor blocks into a Merkle tree and sends its root to the checkpoint contract on Ethereum. The contract accepts it when validators holding more than two thirds of the staked POL have signed. On 12 November 2026 the latest checkpoint, number 116,642, landed at 09:31 UTC and covered 768 Bor blocks. Over the 30 checkpoints before it, the gap between two checkpoints averaged about 17 minutes, with a shortest of about 5 minutes and a longest of about 73, according to Heimdall’s public API. Polygon’s documentation says the length is set by governance, not fixed.
A checkpoint is a fingerprint, not a proof. ETHBEAT puts it plainly: “Contracts on Ethereum do not check whether the state transitions are valid.” The contract checks signatures, not the arithmetic of balances. Withdrawals then rely on that fingerprint: to exit, you burn tokens on Polygon, wait until a checkpoint covers the block of your burn, and present a Merkle proof to the bridge on Ethereum. If the signed root described a false state, the proof would still pass.
Two thirds of the stake sits with 11 validators
So the real question is who holds two thirds of the stake. On 12 November 2026 Heimdall’s API listed 100 validators. ETHBEAT notes the set shrank from 104 to 100 on 5 November 2026, and since 13 October 2026 entry has been gated by a ValidatorPass contract, so joining is no longer open to anyone with enough POL. Voting power is concentrated: the largest validator held 11.70%, the top five 43.21% and the top ten 65.97%.
Coindaro’s arithmetic on those figures: the four largest validators together hold more than a third of the voting power, enough to stall consensus and checkpoints if they stopped signing. The eleven largest hold more than two thirds, enough on paper to sign checkpoints alone. Nothing suggests these validators have ever colluded to forge a checkpoint, and doing so would destroy the value of their own stake. But the trust assumption is there in the contracts: eleven operators, not Ethereum, stand between the bridge and a false state.
Fast finality on Polygon itself
Inside Polygon, finality comes from “milestones”, short votes by validators that Polygon’s finality documentation says typically finalize a transaction within 2 to 5 seconds. A read of a public node on 12 November 2026 showed the “finalized” block one block, a second or two, behind the newest. Polygon’s own announcement presented Rio as the upgrade that ends reorganisations, the reshuffles of recent blocks that can undo a payment already seen as confirmed. That is fast, but it is finality decided by Polygon’s validators. Finality on Ethereum, the kind that lets you withdraw, still waits for the next checkpoint.
Forks, stoppages and a freeze: what Polygon validators have done
A chain run by its own validators can be repaired by them, quickly and sometimes quietly. Polygon PoS has used that power several times. The dates below come from the outlets and pages named.
| Date | Event | What validators did | Source |
|---|---|---|---|
| 3 to 5 Dec 2021 | Critical bug in the contract holding MATIC on the chain, reported by white hats on 3 Dec; an attacker took over 800,000 MATIC (about $1.8M then) | Upgrade by hard fork within 48 hours, disclosed on 29 Dec 2021 | Decrypt, 30 Dec 2021 |
| 10 to 11 Mar 2022 | Block production stopped about eight hours after a small Bor upgrade froze Heimdall | Restart with a “temporary fix” | The Block, 11 Mar 2022 |
| 10 Sep 2025 | Finality delayed on some nodes; blocks kept coming, some RPC services and explorers disrupted | Heimdall hard fork rolled out the same day | Polygon status page |
| 29 to 30 Oct 2026 | Four block producers refuse transactions from five addresses holding about 70.5M POL | Blocklist at Bor level | Polygon forum, 4 Nov 2026 |
| 4 Nov 2026 | Proposal to hard fork and move about 70.49M POL to Polymarket and Binance recovery addresses | Pending, no activation block as of 12 Nov 2026 | Polygon forum |
The December 2021 bug was serious: Decrypt reported that it could have let an attacker mint more than 9.2 billion MATIC. Validators shipped the fix before users knew there was a problem. Most people would call that a good outcome. It is also proof that a few dozen operators could change the rules of the chain in two days without asking holders.
The 2026 proposal shows the same power used on balances. According to the forum thread, about 23.86 million POL comes from the Polymarket incident and about 46.63 million from the Binance one, roughly $6 million together at the POL price of $0.0857 shown by DefiLlama at 09:49 UTC on 12 November 2026. Polymarket and Binance are named as the proposers, and the text calls the fork “an extreme action that should not be reproduced commonly”. One reply on 5 November warned that the precedent could invite court orders to freeze or seize POL, and asked who would decide which future requests are legitimate. The thread had no newer post by 12 November 2026.
The blocklist also shows what rollups were built to prevent. ETHBEAT notes that Polygon PoS has no mechanism against censorship by part of the validator set, “nor a way to force transactions from Ethereum L1”. On Arbitrum One, a user the sequencer ignores can send the transaction through Ethereum, and it must be included within about a day, according to ETHBEAT. The same property that allowed Polygon validators to stop a thief would let them stop anyone.
A 5-of-9 multisig can upgrade Polygon’s bridge with no delay
Validators are not the only trust point. The contracts on Ethereum can be changed. ETHBEAT lists PolygonMultisig, a multisig with a 5-of-9 threshold, as able to upgrade the staking manager, the checkpoint contract and the bridge predicates “with no delay”. A second multisig, 4-of-12, maps new tokens to the bridge. With instant upgrades there is no window to leave before a change you dislike takes effect.
That may change. PIP-93, a draft dated 2 November 2026 and posted for discussion on 5 November, would fold the PoS, AggLayer and Protocol Council multisigs into one Security Council needing 8 of 11 signatures, with seats published by organisation only: Polygon Labs (two seats), Sherlock, OpSek, Hexens, Sigma Prime, Curve, QuickSwap, EthCC, L2Beat and Coinbase, according to the proposal on Polygon’s forum. Routine upgrades proposed by a Polygon Labs multisig would wait 7 days in a timelock, which would give users their first window to leave before a change. The council itself could still act at once. As of 12 November 2026 the proposal was still marked Draft, and either way it would be a council, not Ethereum, that decides.
The money behind these keys is large. ETHBEAT put the value secured on Polygon PoS at $3.70 billion on 12 November 2026, of which about $2.23 billion is canonically bridged from Ethereum, the share that would be exposed if the bridge failed. Stablecoins make up about three quarters of the total.
Polygon’s plan to become a validium, three years on
Polygon PoS was never built as a rollup. In June 2023 it proposed upgrading the chain into a “zkEVM validium”, a chain whose state would be checked by zero-knowledge proofs on Ethereum while its data stayed off Ethereum. ETHBEAT still describes the network as “planning to become a Validium with a state validating bridge”, and its state validation entry for Polygon PoS reads “None” as of 12 November 2026. There is no published date for the switch.
Even if it happens, a validium is not a rollup. The proof would stop validators from forging a state, which is the main bridge risk today, but users would still depend on someone off Ethereum keeping the data available. The ZK rollups lesson explains the difference between validiums and rollups, and how Polygon’s separate ZK rollup, Polygon zkEVM, is being wound down. “Polygon” today is a company, a token and several products, and only one of them, Polygon PoS, carries most of the users.
Gnosis Chain: open validators, a 4-of-7 bridge and its own recovery fork
Gnosis Chain, formerly xDai, takes a different path on validators. According to ETHBEAT’s Gnosis Chain page (see also our Gnosis project page), anyone can join the validator set by staking at least 1 GNO, a far lower bar than Polygon’s 100,000 POL minimum and its pass contract. Blocks come every 5 seconds, fees are paid in xDai, a dollar-pegged token, and staking uses GNO.
Open validators do not make the bridge open. Withdrawals through the xDai bridge and the Omnibridge need signatures from 4 of 7 bridge validators, a separate group, and ETHBEAT spells out the consequence: “The bridge validators can freeze bridge transactions and/or steal bridge-locked and minted assets.” Ethereum cannot see Gnosis Chain’s data at all, and the contracts can be upgraded with no delay. ETHBEAT put the value secured at $0.25 billion on 12 November 2026.
Gnosis also rewrote its own history once. After the Balancer V2 exploit reported on 3 November 2025, which took about $116 million across several chains, a majority of Gnosis validators adopted a soft fork in response that month, then executed a hard fork on Monday 22 December 2025 to recover funds tied to the exploit, according to Cointelegraph. Balances on a chain that calls its blocks final were changed by a vote of its validators. Polygon’s 2026 proposal follows the same template, less than a year later.
Ronin: hacked as a sidechain, relaunched as an “L2” below Stage 0
Ronin, the chain Sky Mavis built for Axie Infinity, is the textbook case of sidechain bridge risk. On 23 March 2022 an attacker who controlled five of the nine bridge validator keys drained 173,600 ETH and 25.5 million USDC in two transactions; the theft went unnoticed until 29 March, when a user could not withdraw 5,000 ETH, as The Block reported. The loot was worth more than $600 million at the time. Sky Mavis later raised $150 million in a round led by Binance to reimburse users, and about $35.7 million has been recovered since, according to The Block. US authorities linked the theft to North Korea’s Lazarus group in April 2022; the mechanics are in our guide to cross-chain bridges and their hacks.
Four years later Ronin changed category. On 12 May 2026 it hard forked at block 55,577,490 into an OP Stack chain posting its data to EigenDA, according to ETHBEAT, after about ten hours of scheduled downtime announced by Ronin and reported by The Block. RON stayed the gas token, and the upgrade was set to cut its yearly inflation from above 20% to below 1%. Ronin now calls itself an Ethereum layer 2.
ETHBEAT’s Ronin page is harsher: “Ronin is not even a Stage 0 project.” Its reasons, as of 12 November 2026: the data sits on EigenDA without its availability being verified on Ethereum, so Ronin is an optimium, not a rollup; the fault proof program “cannot execute the Ronin state transition”, so disputes cannot be settled by execution; and RoninConduitOwner, a 5-of-6 multisig, can upgrade core contracts with no delay. ZK proofs from the Kailua system were switched on on 1 July 2026, but since 7 September 2026 withdrawals have settled through a permissioned dispute game again. On 9 October 2026 the threshold of the multisig owning the RISC Zero verifier fell from 3 of 5 to 2 of 5.
Some things did improve. Users can now force a transaction through Ethereum, with up to a 12-hour delay, and once a state root is settled, withdrawals are available on Ethereum after 3 days 12 hours. The lesson is that a migration is a direction, not a result: Ronin moved from trusting nine bridge keys to trusting one permissioned proposer and a handful of multisigs. There is a further twist: ETHBEAT notes that the new OP Stack bridge holds almost none of the $0.18 billion it counts as secured on Ronin (12 November 2026). Most bridged tokens moved in April 2025 to Chainlink CCIP pools, secured by Chainlink’s own node network, and residual balances sit in the legacy gateway run by Ronin’s bridge operators.
Security compared: Arbitrum One, Polygon PoS, Gnosis Chain and Ronin
The table sums up the assumptions behind each chain as ETHBEAT describes them on 12 November 2026, with Arbitrum’s withdrawal window from Arbitrum’s documentation. Arbitrum’s own trade-offs, from its Security Council to its BoLD dispute game, are covered in our lesson on optimistic rollups.
| Question | Arbitrum One | Polygon PoS | Gnosis Chain | Ronin (since May 2026) |
|---|---|---|---|---|
| ETHBEAT category, stage | Optimistic rollup, Stage 1 | Other, stage not applicable | Other, stage not applicable | Other, Stage 0 requirements missing |
| Value secured (12 Nov 2026) | $8.79bn | $3.70bn | $0.25bn | $0.18bn |
| Who checks the state on Ethereum | Anyone, through fraud proofs | Nobody: checkpoints are signed, not verified | Nobody: bridge signers attest | A permissioned proposer |
| Where the data is | Ethereum (blobs) | Polygon validators | Gnosis validators | EigenDA, not verified on Ethereum |
| Can users force a transaction | Yes, up to about 1 day delay | No | No | Yes, up to 12 hours delay |
| Who can upgrade, and how fast | Regular upgrades leave 10 days to exit; Security Council can act at once in emergencies | 5-of-9 multisig, no delay | No delay | 5-of-6 multisig, no delay |
| Who could take bridged funds (assumption) | Security Council in an emergency | Two thirds of stake (11 validators) or the upgrade multisig | 4 of 7 bridge validators | The proposer and the multisigs; most tokens sit in Chainlink CCIP pools instead |
| Withdrawal to Ethereum | About 6.4 days, or a fast bridge | Next checkpoint, then a claim on Ethereum | After bridge signatures | 3 days 12 hours through the OP Stack bridge; most tokens leave through Chainlink CCIP |
Read across the rows and the sidechain vs rollup line is clear. Arbitrum One still has a council with emergency powers, so it is not trustless. But the default is that Ethereum can overrule the operator, and users can walk away before ordinary upgrades. On the three other chains, the default is that the operators decide.
Why ETHBEAT keeps sidechains in its tables under “Others”
ETHBEAT has not removed Polygon PoS or Gnosis Chain from its scaling pages. On 12 November 2026 its API counted 80 projects of the layer 2 type securing about $35.93 billion, and filed 57 of them in a category called “Others”. Ronin is there too, with Stage 0 requirements still missing. For 16 of them, among them Polygon PoS, Gnosis Chain and the wound-down Polygon zkEVM, stages do not apply at all. The reason shown for both Polygon PoS and Ronin is the same: the proof system is not fully functional.
The choice is practical. These chains move real Ethereum assets through bridges, so users want them watched; yet scoring them on the rollup scale would mislead. The stage system itself is the subject of a later lesson in this path, Layer 2 risks and L2BEAT stages explained, and the layer 2 basics lesson gives the short version.
Arbitrum vs Polygon: the difference in plain terms
Asked “what is the difference between Arbitrum and Polygon?”, the precise answer starts with which Polygon. Polygon Labs is a company; POL is a token; Polygon PoS is the chain people use; AggLayer and the wound-down Polygon zkEVM are other products. The comparison that matters is Arbitrum One against Polygon PoS.
Arbitrum One is an optimistic rollup built by Offchain Labs and governed by the Arbitrum DAO, whose votes use the ARB token (see our Arbitrum project page). It posts its data to Ethereum, anyone can challenge a wrong claim, and Ethereum settles the dispute. Polygon PoS is a sidechain secured by 100 POL validators whose checkpoints Ethereum stores without checking (see our Polygon project page). Withdrawals from Arbitrum take about 6.4 days because of the challenge window; withdrawals from Polygon PoS wait only for the next checkpoint, minutes to hours, because there is nothing to challenge.
Fees no longer settle the sidechain vs rollup choice. Since Ethereum added blobs in March 2024, rollups post their data cheaply, as our lesson on blobs and EIP-4844 explains, and the old argument that sidechains are cheaper has faded. growthepie’s data for 11 November 2026:
| Chain (11 Nov 2026) | Transactions | Median fee | Total fees paid |
|---|---|---|---|
| Polygon PoS | 3.97M | $0.0066 | $41,900 |
| Arbitrum One | 1.02M | $0.0044 | $14,000 |
| Base | 7.68M | $0.0017 | $76,200 |
| Ronin | 0.149M | $0.0001 | $25 |
| Ethereum L1 | 1.96M | $0.025 | $256,800 |
On that day the median Arbitrum transaction cost less than the median Polygon PoS one. DeFi activity differs too: DefiLlama counted $1.38 billion of DeFi deposits on Arbitrum and $623 million on Polygon at 09:49 UTC on 12 November 2026. Those are DeFi deposits, a narrower measure than ETHBEAT’s value secured, which also counts tokens simply held on the chain.
What the difference means when you pick a network
Most people meet this choice on an exchange withdrawal screen that offers “Ethereum”, “Arbitrum One” and “Polygon” for the same USDC. Sending on a network the receiving address does not support can cost you the funds; the layer 1 vs layer 2 guide linked above has the checklist for that. The questions below are about what happens once the money is there.
Native or bridged matters. Circle lists native USDC on both Arbitrum and Polygon PoS in its contract address list, so USDC sent there by an exchange is usually Circle’s own token, redeemable by Circle, and does not depend on the chain’s bridge. Gnosis Chain and Ronin were not on that list on 12 November 2026, so USDC there is a bridged version whose backing sits in a bridge. Tokens you move yourself through a bridge carry the bridge’s risk on every chain.
Four questions cover most of the rest, whatever the chain calls itself:
- Who can upgrade the contracts holding my funds, and do I get time to leave first?
- If the operators ignore my transactions, can I force one through Ethereum?
- Where is the transaction data stored, and could I rebuild my balance from Ethereum alone?
- How long does a withdrawal to Ethereum take through the official bridge, and who pays out a faster one?
ETHBEAT’s project pages answer each of these per chain. None of them says which network to use; that depends on what you do and how much you hold, and nothing in this lesson is a recommendation.
For readers in the United States and the United Kingdom, the network choice is technical, not legal: no SEC, CFTC or FCA rule treats a sidechain differently from a rollup. Taxes follow the asset, not the chain. A swap or a purchase made with crypto can be a taxable disposal on any network under IRS and HMRC rules.
Two decisions are still open on Polygon’s forum, the recovery fork and PIP-93, and Polygon PoS has no date for its validium switch. On Ronin, the Kailua ZK game is still deployed but no longer settles withdrawals. The next lesson of this path, State channels explained, looks at the oldest scaling idea of all: keeping transactions off any chain until the end.
