Polkadot warns Fearless Wallet users to move funds after key leak
Four versions of the third-party browser extension sent private keys to an attacker-controlled server for more than a year
Polkadot has a blunt message for anyone who used the Fearless Wallet browser extension since February 2025: assume your accounts are compromised, and move your funds.
The warning came in a security notice published on October 21, 2026. It describes a flaw that quietly shipped users’ private keys to a server controlled by an attacker. The flaw had been live, on and off, for roughly a year and a half.
What went wrong inside the extension
According to Polkadot’s notice, four versions of the Fearless Wallet extension were handing out copies of that master key. The affected releases are 3.0.1, 3.0.3, 3.0.4, and 3.0.5. When a user unlocked the wallet, the extension sent their private key to an attacker-controlled server.
The malicious code entered the project on February 19, 2025. It arrived through a GitHub pull request tied to the TON ecosystem.
The leak did not run continuously. Polkadot said it was active intermittently until at least October 10, 2026. That stretch covers more than 19 months of potential exposure for anyone running the compromised builds.
The damage so far is concrete. Eight users have reported unauthorized transactions linked to the exploit, totaling 17,286 DOT. Because a leaked key can sit unused until an attacker decides to strike, the number of exposed accounts could exceed the number of drained ones.
When Polkadot issued its warning, the Chrome Web Store still listed an affected version of the extension. That listing showed around 6,000 users.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
A third-party wallet, not an official one
Polkadot was careful to draw a line in its notice. Fearless Wallet is a third-party product. It has never been an official wallet of the Polkadot network.
The timeline also raises uncomfortable questions. Early complaints describing similar problems after an update were logged as far back as October 2025. The detailed public explanation of the coding flaw did not arrive until the October 2026 announcement. That leaves roughly a year between the first user reports and a full public accounting.
What affected users are being told to do
Polkadot’s guidance is straightforward. Anyone who interacted with the vulnerable extension since February 2025 should treat all associated accounts as compromised.
Users are being told to generate new keypairs in a different wallet and transfer their funds immediately. Polkadot recommended Nova Wallet for that move.
Simply updating Fearless Wallet does not solve the problem. If a key has already leaked, the attacker still holds a working copy. The only real defense is to move assets to a fresh key the attacker has never seen.
Staked or locked funds add a wrinkle. Polkadot noted that recovering them may require additional steps. In certain scenarios, it pointed users toward tools such as PAPI Rescue.
Polkadot also flagged a second-order threat: recovery scams. The foundation cautioned users to watch for opportunists posing as helpers who promise to retrieve lost funds.