Polkadot News: Which Fearless Wallet Versions Exposed Private Keys? Polkadot News today: the Polkadot Community Foundation says the Fearless Wallet browser extension leaked private keys. The
Polkadot News today: the Polkadot Community Foundation says the Fearless Wallet browser extension leaked private keys. The code was introduced in February 2025 and was active during periods extending to October 10, 2026, according to the Foundation's notice and linked technical analysis.
Fearless is a third-party wallet, not an official Polkadot product.
The technical analysis says the extension collected recovery phrases or account backup files with their passwords, applied encryption using an empty password, and sent the resulting data to an external server. Because the password was empty, the encryption did not protect the data from the recipient. Behaviour differed between versions.
Item
Detail
Affected versions
3.0.1, 3.0.3, 3.0.4, 3.0.5
Chrome listing, checked October 22
Version 3.0.5, 6,000 users
The code was removed from the public repository on June 25, 2026, but that did not remove it from previously installed copies. In versions 3.0.3 to 3.0.5, the remote switch has been off since October 10, 2026, according to the technical analysis. Those installed copies still contain the code, and the switch could be turned on again. Version 3.0.1 used an earlier variant without that remote switch.
The 6,000 figure is a store user count, not a victim count.
The private key controls the account, not the app. In a private key leak, the stolen copy stays valid. Importing the same key into another wallet, changing a password or reinstalling the extension does not cancel it.
Who is at risk:
Chrome users since February 2025: treat every account as compromised
Firefox users: treat keys as compromised. Published packages could not be recovered
Android and iOS apps: the technical analysis says reviewed versions did not contain the identified code. A key also used in the extension is still compromised
Nova Wallet: Nova says its apps are not affected. If you entered a seed phrase into Fearless, create a new Nova wallet and transfer assets
This Polkadot News check also covers losses. The Foundation reports eight user cases involving unauthorized transactions totalling 17,286 DOT. However, the linked case log lists 15,571.99 DOT across eight cases, plus 54,450.36 DED. The totals do not currently match. The log also cautions that the reports and matching on-chain transactions do not independently establish theft or prove how each account's keys were exposed.
One case records 8,995.56 DOT moved on September 23, 2026. A transaction confirms a transfer, not how the account was compromised.
If you used the Fearless browser extension at any time since February 2025, treat every account held in it as compromised. Create a completely new keypair in a different, well-maintained wallet and move assets to the new addresses. Do not import the old recovery phrase into the new wallet as a replacement for generating fresh keys. Check every chain where the old keys were used, and remove the extension after the funds are safe.
For staked or governance-locked funds, follow the foundation's official instructions and PAPI Rescue before unstaking. Never share your seed phrase or private key with any recovery service. Ignore unsolicited offers. Good DOT wallet security means copying addresses only from your own new wallet.
Not found in the sources reviewed: a Fearless statement, or who added the code.
This Polkadot News review finds an official warning and loss totals that do not match. Treat every key used in the extension as exposed and move funds to new keys.
YMYL Disclaimer: This article is for information purposes only and is not financial, investment, or trading advice. Information is based on the Polkadot Community Foundation's October 21, 2026 security notice, its linked technical analysis and case log as supplied, Nova Wallet's statement as supplied and the Chrome Web Store listing checked on October 22, 2026, as of October 22, 2026. Figures, versions and recommendations may change. No person is accused of wrongdoing. Crypto assets are volatile and carry risk of loss, including full loss of funds. Always verify current details directly with official sources and consult a licensed advisor before making decisions.
