Fearless Wallet extension leaked private keys for 20 months; 17,286 DOT stolen

If you have used the Fearless Wallet browser extension since February 2025, treat your keys as stolen. The Polkadot Community Foundation warned on 21 October that the third-party extension had been sending users' private keys to a server run by an attacker. Eight users have reported unauthorised transfers totalling 17,286 DOT, roughly $18,000 at today's price of about $1.03 (CoinGecko).

What happened

According to the foundation's notice and a write-up by the Polkadot Technical Fellowship, the malicious code was added to the extension's public source code on 19 February 2025, inside a large update titled "TON ecosystem". In versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5, unlocking the wallet sent the recovery phrase, or the keystore file and password, to an outside server. Blockchain security firm SlowMist, which logged the incident, said a remote on/off switch let the attacker activate the theft only at certain times, which made it harder to spot.

The code was removed from the source in June, and the switch has been off since 10 October 2026. But installed copies of 3.0.3 to 3.0.5 still contain it and check the switch every time they are unlocked, so there is no safe version to update to.

Who is affected

• Extension users: anyone who used the Chrome extension at any point since February 2025. The Firefox version used the same code and should be treated the same way.
• Mobile-only users: the reviewed Android and iOS apps do not contain the code. But if the same recovery phrase was ever loaded into the extension, for example by restoring a Fearless Google Drive backup, that phrase is compromised in every app.
• People who already switched wallets: moving to another app only helps if you also generated a new phrase. An account is controlled by its seed phrase, not by the app you open it with.

Fearless Wallet is built by an independent team and has never been an official Polkadot wallet, the foundation stressed.

Why fast unbonding raises the stakes

As CryptoSlate points out, the breach lands three months after Polkadot cut the waiting time to unstake. Under Referendum 1910, which took effect on 6 July, nominators can withdraw staked DOT in roughly one to two days instead of up to 28. That is better for liquidity, but it also gives an attacker who holds your keys far less time before staked coins become transferable. Nobody has shown that the shorter period caused any of the reported thefts.

The foundation says staked, pooled or governance-locked DOT cannot be moved straight away, and suggests contacting PAPI Rescue, a recovery tool from the polkadot-api team, before you start unbonding from a compromised account. For background on how staking and unbonding work, see our staking guide and our explainer on what Polkadot is.

The bigger lesson

Browser extension wallets are convenient but sit inside the riskiest software most people run. Keeping larger amounts on a hardware wallet, installing extensions only from maintained projects, and removing ones you no longer use all reduce the damage when a single app goes bad. Our guide to storing crypto safely covers the basics.