Polkadot Warns Fearless Wallet Users to Move Funds After Private-Key Leak

The Polkadot Community Foundation urged Fearless Wallet browser-extension users on Oct. 21 to create new keys and move their funds, saying four versions contained code that sent private keys to an attacker’s server when the wallet was unlocked.

“If you have used the Fearless Wallet browser extension since February 2025, assume that every account in it is compromised,” the foundation said in its security notice.

Polkadot said its Technical Fellowship investigated the issue on the foundation’s behalf. Its warning urged users to “move your funds as soon as possible.”

The notice identifies extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5. It says the code entered the public repository on Feb. 19, 2025, in a change titled “TON ecosystem,” and was active at different times between February 2025 and Oct. 10, 2026. Fearless is a third-party application, not an official Polkadot wallet, the foundation stressed.

A technical analysis linked by the foundation says the extension collected recovery phrases or account-backup files together with their passwords, encrypted the information using an empty password and sent it to an external server. The version 3.0.5 source code contains the configuration check, account-data collection and outgoing request described in the analysis.

The analysis says the code was removed from the repository on June 25, 2026, but installed copies of versions 3.0.3 through 3.0.5 retain it. A remote switch has been off since Oct. 10 but could reactivate those copies.

On Oct. 21, the Chrome Web Store listing still offered version 3.0.5 with 6,000 users. That is a store user count, not a count of compromised accounts; the notice does not quantify the total exposed population. The foundation says Firefox used the same code and advises its users to treat keys as compromised too, although the technical analysis says published Firefox packages could not be recovered.

The notice cites eight users reporting unauthorized transactions it says could be linked to the exploit. Its linked case log cautions that matching transactions onchain does not establish how each account’s keys were exposed. In one listed case, Subscan confirms an 8,994 DOT transfer on Sept. 23, 2026.

New Keys, Not Just a New App

The foundation says changing a password, reinstalling the extension or importing the same recovery phrase into another app does not secure an exposed account. Users should create a fresh keypair in a different, well-maintained wallet and transfer funds across every chain where the old keys were used, preferably without unlocking Fearless again. Once funds are safe, they should remove the extension.

Reviewed Android and iOS versions did not contain the code, according to the notice. But any key previously used in the browser extension should be treated as compromised wherever it is used, including on mobile.

For staked funds or assets locked in governance, the notice recommends seeking help from PAPI Rescue before unstaking. It warns users never to share private keys, including with recovery teams, and to ignore unsolicited recovery offers.