- Fearless Wallet’s browser extension sent private keys to an attacker’s server at times from February 2025 to October 10, 2026.
- Eight users reported unauthorized transactions totaling 17,286 DOT, the Polkadot Community Foundation said.
- The foundation told users to create a new key in a different wallet and move their funds.
The Polkadot Community Foundation warned anyone who used the Fearless Wallet browser extension since February 2025 to consider all the accounts in the extension compromised and move their funds straightaway.
On February 19, 2025, code was added that sent private keys to an attacker’s server and ran at varying times until October 10, 2026.
Four builds shipped recovery phrases to tonscanner.org
The code was carried in four builds: 3.0.1, 3.0.3, 3.0.4, and 3.0.5. According to the foundation’s October 21 security notice, it was activated by an unlock with the right password.
A technical analysis linked in the notice says the extension gathered the recovery phrase of each account or its backup file and wallet password. It encrypted them with an empty password (which is reversible by anyone) and shipped them to tonscanner.org.
A private key has total control over an account. Even changing a password or reinstalling the extension doesn’t help, as anyone with one can sign transfers and empty the balance, the foundation said.
The Firefox build was running the same code and is no longer listed. And if someone used it in the window, those keys should be considered compromised too.
The code is absent from the reviewed Android and iOS apps. But any private key that was in the extension at any point is compromised wherever it’s used, the notice said.
The code was merged from GitHub pull request #1022 as part of a sizable change called “TON ecosystem” to the public source of the extension. Versions 3.0.3 – 3.0.5 used a config file in a separate public repo as a remote on/off switch.
The switch is recorded as on in the activity log on GitHub for nine periods between March 7, 2025, and October 10, 2026. In all, it was about 571 days.
The code was removed from the project’s source on June 25, 2026, but installed copies of versions 3.0.3 to 3.0.5 still carry it. Each time the wallet is unlocked, they check a remote switch that is off for now but could be turned back on. The foundation told users to move their funds first and uninstall the extension after.
Eight users report 17,286 DOT in unauthorized transfers
The foundation said eight users have reported unauthorized transactions possibly linked to the exploit, totaling 17,286 DOT. Its case log says the reports don’t prove anything was stolen.
The first case in the log is September 30, 2025, with a Reddit post on October 6, 2025. Some users said the funds moved as soon as they unlocked the wallet without any action on their part.
Version 3.0.5 was still in the Chrome Web Store with 6,000 users on October 21.
Fearless Wallet is a third-party app developed by an independent team. The foundation said it is not, and never was, an official Polkadot wallet.
Its advice is a new keypair in a different and well-maintained wallet. It suggests Nova Wallet.
Funds need to be shifted off the old account on each chain it was used on, ideally without unlocking Fearless again.
Staked coins, nomination pool deposits, and locked coins for governance can’t move right away. Polkadot nominators can unbond in as little as one to two days. The announcement steers users to PAPI Rescue, built by the polkadot-api team, ahead of unstaking.
The foundation said that no one, including the PAPI Rescue team, needs a user’s private keys. It warned that no legitimate person will message first, offering to recover funds.
Earlier this month, Polkadot’s dotUSD stablecoin went live.
At the time of writing, DOT is trading at $1.17 with 3% gains in the past seven days. The token lost 62.7% of its value in one year.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
Which Fearless Wallet versions are affected?
Versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the browser extension. The Firefox build used the same code.
How much has been stolen so far?
Eight users have reported unauthorized transactions totaling 17,286 DOT, though the reports do not confirm theft.
What should affected users do?
Create a new keypair in a different, well-maintained wallet, such as Nova Wallet, then move funds off the old account.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
