Polkadot Warns Fearless Wallet Users: Assume Compromise, Move Funds Now
Polkadot told anyone who used the Fearless Wallet extension since February 2025 to assume their keys are compromised. Four releases leaked private keys to an attacker server, eight users report 17,286 DOT stolen, and an affected Chrome version still showed around 6,000 users.
If you have used the Fearless Wallet browser extension since February 2025, treat your keys as burned. Polkadot said so in a security notice published on October 21, 2026, telling users to generate new keypairs in a different wallet and move their funds immediately.
Four extension releases (3.0.1, 3.0.3, 3.0.4 and 3.0.5) sent users' private keys to an attacker-controlled server whenever the wallet was unlocked. Updating the extension does not help. A key that has already leaked stays leaked.
How the code got in
According to the notice, the malicious code entered the project on February 19, 2025, through a GitHub pull request tied to the TON ecosystem. The leak did not run continuously, but it was active on and off until at least October 10, 2026.
That is more than 19 months of potential exposure. Anyone who unlocked the wallet in that stretch should assume the worst.
The damage so far
Eight users have reported unauthorized transactions linked to the exploit, totaling 17,286 DOT. That is the reported number, not the ceiling. A leaked key can sit untouched until the attacker decides to use it, so the count of exposed accounts could run well above the count of drained ones.
The affected code was also still within reach. When Polkadot issued the warning, the Chrome Web Store still listed an affected version showing around 6,000 users.
What Polkadot wants users to do
The guidance is blunt: create fresh keypairs in a different wallet and transfer funds right away. Polkadot recommended Nova Wallet. Staked or locked funds may need extra steps, and the notice pointed users to tools such as PAPI Rescue in certain scenarios. It also warned users to watch for recovery scams.
Polkadot also drew a line around the network itself. Fearless Wallet is a third-party product, it said, and has never been an official wallet of the Polkadot network.
The disclosure gap
Timing is the uncomfortable part. Early complaints about similar problems after an update were logged as far back as October 2025, yet the detailed public explanation arrived only with this month's announcement. A gap of roughly a year between first complaints and full disclosure is hard to wave away.
For DOT holders, the practical takeaway is narrow but urgent: this is a compromise in a third-party wallet, not a protocol failure, and a separate matter from the earlier Polkadot bridge exploit we covered. It is also a supply chain lesson. One malicious pull request kept shipping keys out of this extension for roughly a year and a half. If you used Fearless, rotate keys first and ask questions after.
