Polygon

Polygon started in 2017 as Matic Network, a project to make Ethereum cheaper and faster, and took the Polygon name in 2021. Its main network, now called Polygon Chain in the documentation and still widely known as Polygon PoS, is an EVM-compatible chain that runs its own validators and periodically anchors its state to Ethereum. Polygon Labs now presents itself mainly as payments infrastructure, and in 2026 it acquired Coinme and Sequence and launched what it calls the Open Money Stack.

The website, the Portal and related interfaces are provided by Polygon Labs UI (Cayman) Ltd., according to the terms of use last updated 17 October 2025. The company's structured data gives a registered address care of Harneys Fiduciary (Cayman) Limited in Grand Cayman. Polygon's about page lists Marc Boiron as CEO of Polygon Labs and Sandeep Nailwal as co-founder and CEO of the Polygon Foundation, a separate body.

The chain's gas and staking token is POL, which replaced MATIC at a 1:1 ratio. MATIC held on Polygon Chain converted automatically. MATIC on Ethereum has to be migrated through the Portal's upgrade page, and stakers do not need to act.

The native bridge, reached through the Polygon Portal, connects Ethereum and Polygon Chain and nothing else. Depositing locks tokens in a contract on Ethereum and mints the same amount of a pegged token on Polygon. Withdrawing burns the tokens on Polygon and releases the originals on Ethereum. The circulating supply of the token does not change.

Deposits are the quick direction, and the Portal shows an estimated arrival time when you confirm. Withdrawals are slower because Ethereum has to see proof that the burn happened. Polygon's validators bundle the chain's recent blocks into a checkpoint, a Merkle root signed by a majority of the validator set, and submit it to Ethereum. Polygon's bridging guide says checkpoints land roughly every 30 minutes. After the checkpoint containing your burn is accepted, you, or the Portal on your behalf, call the exit function on Ethereum to claim the tokens, paying Ethereum gas for that step.

Polygon Labs also runs Agglayer, a separate bridge for chains built with its CDK toolkit. Agglayer uses pessimistic proofs, which its documentation says stop a compromised chain from withdrawing more than it deposited. Agglayer is a different system from the PoS bridge described here. The older Polygon zkEVM is deprecated, and the Portal guide says new integrations should not use it.

Searches for a BNB Chain, Solana, Arbitrum or Avalanche route to Polygon will not find a native Polygon bridge, because none exists. The Portal covers those routes by embedding outside services. Its guide names a Socket widget for faster transfers, KyberSwap for token swaps and the 0x API for a Refuel feature that buys destination gas. Each of these carries its own contracts, fees and trust assumptions, separate from Polygon's own bridge.

For assets with an issuer-run transfer system, such as USDC, the issuer's own route avoids a wrapped token. A token bridged through the native PoS bridge is a Polygon-side copy backed by tokens locked on Ethereum. A token bridged through a third party is backed by whatever that bridge locks. For a side-by-side view of how the native route's trust model compares with other bridges, see how the Polygon PoS bridge compares with other crypto bridges.

Polygon's documentation does not list a bridge fee for the native route, and we found no protocol fee on the Portal pages we checked. The cost is network gas: an Ethereum transaction to deposit, a Polygon transaction to start a withdrawal, and a second Ethereum transaction to claim it. On a withdrawal, the Ethereum claim is usually the expensive leg. Polygon Chain itself is cheap; Polygon Labs cites an average transaction cost of $0.002.

Third-party routes inside the Portal price themselves. The Socket, KyberSwap and 0x integrations quote their own fees and exchange rates in the interface. Polygon's documentation does not publish those charges.

This is the point most bridge guides skip. Polygon's reference page on multisigs states that multisig wallets control contract upgrades on Polygon Chain. The key ones are:

• Ethereum: a 5-of-9 multisig, address 0xFa7D2a996aC6350f4b56C043112Da0366a59b74c, which can upgrade the PoS and staking contracts on Ethereum and address unexpected bugs in them. Signatories listed: Quickswap, Curve, Polygon, Horizon Games and Cometh.
• Polygon chain: a 5-of-8 multisig that can upgrade custom child token contracts, with the same listed signatories.
• Ethereum: a 4-of-8 multisig, signed by Polygon, limited to mapping custom tokens, with no access to deposits or withdrawals.

The page lists five organizations for nine and eight signer slots, so some organizations hold more than one key; the page does not break this down. Curve is one of them. Polygon notes that these multisigs cannot censor transactions, including bridge transactions. But five signers can change the code of the contracts that hold the locked funds, and that power is the main trust assumption in the bridge. A footnote says the functions are planned to move to on-chain governance using timelock contracts. We found no date for that change.

Polygon's security pages add that its own employees who sign must use dedicated hardware wallets on managed company machines, may not use hot wallets, and that corporate multisigs are monitored around the clock.

Polygon's security reports page links audits of the PoS Portal and the PoS contracts on GitHub, done by multiple firms, plus an Informal Systems audit of the Heimdall consensus client and audits of the POL token by ChainSecurity and Sigma Prime. Polygon Labs has held ISO/IEC 27001:2022 certification since March 2024. The certification covers its information security management, not the correctness of any contract.

The Polygon Chain bug bounty on Immunefi covers the Bor client, the Heimdall consensus layer, the bridge contracts and the staking contracts. It pays up to $250,000 for critical findings, a low ceiling relative to the sums the bridge holds. Agglayer has a separate program on Cantina, also capped at $250,000.

We found no exploit of the PoS bridge contracts in the DefiLlama hacks database. That database does list a December 2021 incident on the Polygon chain, about $2.04 million, recorded as an improper access control flaw and not classed as a bridge hack. Many other hacks it lists on Polygon affected individual apps and exchanges, not Polygon's own contracts.

A withdrawal through the Portal has two transactions. Start it on Polygon, which burns the tokens. Wait for the checkpoint, which Polygon's guide puts at roughly every 30 minutes, though it can slip when Ethereum gas is high. Then open the Transactions page in the Portal and click claim, which sends the Ethereum transaction that releases your tokens. For MATIC-era tokens, the Portal shows an Initiate Claim button once the funds are ready. The tokens arrive only after that claim is confirmed, so keep enough ETH in the wallet to pay for it.

If the Portal is unavailable, the exit can be completed directly against the RootChainManager contract on Ethereum, using the burn transaction hash, as Polygon's developer guide describes. Connect only to portal.polygon.technology. Polygon's support runs through a Discord server linked from its website; no genuine support agent needs your seed phrase. Before approving a token for the bridge, check the spending allowance requested (how token approvals work).

The project's timeline, from Polygon's about page and documentation:

• 2017: founded as Matic Network.
• 2020: mainnet launches.
• 2021: expansion into zero-knowledge technology through acquisitions and rename to Polygon; Immunefi bug bounty live from 13 September 2021.
• March 2024: Polygon Labs receives ISO/IEC 27001 certification.
• 2024: Agglayer announced and launched.
• 2026: Polygon Labs acquires Coinme and Sequence and launches the Open Money Stack.