Polkadot has issued a security alert over the Fearless Wallet browser extension, telling users to move their funds after finding that the third-party wallet had been leaking private keys. Use
Polkadot has issued a security alert over the Fearless Wallet browser extension, telling users to move their funds after finding that the third-party wallet had been leaking private keys. Users who relied on the extension are being urged to treat their accounts as compromised and to shift assets, including $DOT, to new wallets.
The Polkadot Community Foundation has warned that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the Fearless browser extension contain malicious code, and that users' private keys may be sent to an attacker's server when they unlock their wallets. The code was introduced into the extension's public source code on February 19, 2025, as part of a major update titled "TON ecosystem," and was activated intermittently until October 10, 2026.
That puts the potential exposure at around twenty months for anyone who used the affected builds. Because a leaked key can sit unused until an attacker decides to strike, the number of exposed accounts could exceed the number of drained ones.
Losses have already been reported. Eight users have reported unauthorized transactions possibly related to the vulnerability, involving 17,286 DOT. Chrome still listed an affected extension version with 6,000 users as the foundation urged holders to create fresh keys.
It is also worth noting that Fearless Wallet is developed by an independent team and is not an official Polkadot wallet.
The foundation advises users who have used the affected plugin since February 2025 to immediately generate new keys and transfer their assets. Merely changing passwords or reinstalling the plugin will not suffice. Keys should be created in a different wallet, and assets moved across.
Mobile users are in a better position, but not entirely clear. The code has not been detected on mobile platforms, though users who previously imported the same private key into the browser plugin should also be considered compromised. The Chrome version is confirmed to be affected, and the Firefox version uses the same code.
Users with assets in staking, nomination pools or governance locks face an extra step. According to a report by KuCoin News, the polkadot-api team has built a tool called PAPI Rescue to help recover such funds.
The incident is a reminder that browser-based wallets hold private keys in an environment that depends on every code update being trustworthy. Holders of $DOT who use any browser extension should review which wallets they have installed and which keys have been imported into them.
Crypto Briefing: Polkadot warns Fearless Wallet users to move funds after key leak
The Defiant: Polkadot warns Fearless Wallet users to move funds after private-key leak
TechFlow: Fearless Wallet browser extension private key leak risk
