Polkadot Warns Fearless Wallet Users About Key Leak

Polkadot issued an unequivocal warning to everyone who used the Fearless Wallet browser extension since February 2025: consider accounts compromised and transfer funds immediately. The security notice was published on October 21, 2026, and describes a vulnerability that for over a year sent users' private keys to a server controlled by an attacker.

According to Polkadot, the keys were transmitted by four versions of the extension: 3.0.1, 3.0.3, 3.0.4, and 3.0.5. When unlocking the wallet, the extension sent the private key to the attacker's server. The malicious code entered the project on February 19, 2025, through a merge request on GitHub associated with the TON ecosystem. The leak was not constant—it was active periodically at least until October 10, 2026, covering more than 19 months of potential vulnerability.

The damage is already specific: eight users reported unauthorized transactions amounting to 17,286 DOT. Since the leaked key can remain unused until the moment of attack, there may be more affected accounts than those robbed. At the time of the warning, the Chrome extension store still showed the affected version—about 6,000 users.

Polkadot specifically emphasized: Fearless Wallet is a third-party product and was never an official wallet of the network. The timeline also raises questions: complaints about similar issues after the update were recorded back in October 2025, and a detailed public explanation appeared only a year later, in October 2026.

What affected users should do. Everyone who interacted with the vulnerable extension since February 2025 should consider the associated accounts compromised. A new key pair should be generated in another wallet and funds transferred immediately; Polkadot recommended Nova Wallet. A simple update of Fearless Wallet is not enough: if the key has already leaked, the attacker retains a working copy, and the only real protection is new keys that they have not seen. For staked or locked funds, additional steps may be required; in some cases, Polkadot points to tools like PAPI Rescue. The foundation also warned of a second threat—fraud under the guise of fund recovery: scammers pose as helpers and promise to return lost funds.