Polkadot Warns Fearless Wallet Extension Leaked Private Keys Since February 2025

Polkadot has issued an urgent security warning after investigators discovered that multiple versions of the Fearless Wallet browser extension secretly transmitted users’ private keys to an attacker-controlled server for periods dating back to February 2025.

The Polkadot Community Foundation disclosed the vulnerability on October 21, 2026, identifying versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 as affected. Eight users have reported unauthorized transactions potentially linked to the incident, involving 17,286 DOT.

Anyone who used the extension since February 2025 has been instructed to abandon their existing wallet keys, generate new credentials through a different wallet application and transfer their remaining assets immediately.

Malicious Code Remained in Fearless Wallet for Over a Year

The malicious functionality entered Fearless Wallet’s public GitHub repository on February 19, 2025, through a large code change titled “TON ecosystem.”

The technical investigation identified functionality that extracted recovery phrases or account keystore files alongside wallet passwords whenever users successfully unlocked the extension.

The stolen information was encrypted using an empty password, making the protection reversible, before being transmitted to an external server.

Later versions introduced a remotely controlled configuration mechanism capable of activating or disabling the malicious behavior. The code was removed from the public source on June 25, 2026, but remained embedded in installed extension versions 3.0.3 through 3.0.5.

The remote mechanism remained active during multiple periods through October 10, 2026. Previously installed copies can still reactivate the functionality, leaving users exposed even after the latest identified transmission period ended.

The incident resembles the earlier Trust Wallet extension breach, which involved malicious browser-extension code capable of exposing wallet recovery credentials.

Eight Users Report Unauthorized DOT Transfers

The Foundation’s October 21 warning identified eight reported cases involving 17,286 DOT, although its accompanying public transaction records separately total 15,571.99 DOT and 54,450.36 DED. The difference between the DOT figures has not been explained.

Reported incidents occurred between September 2025 and September 2026, with the largest documented case involving approximately 8,996 DOT transferred from a wallet on September 23.

The investigation confirmed the malicious functionality in the Chrome extension. Firefox used the same source code, although its published extension packages were unavailable for inspection.

Reviewed Android and iOS applications did not contain the malicious code. However, mobile users who previously imported recovery credentials into the affected browser extension remain exposed.

Unlike the recent Qubic wallet exploit, which involved predictable wallet seeds, Fearless Wallet’s vulnerability transmitted existing recovery credentials directly to an external destination.

Polkadot Urges Immediate Wallet Migration

Affected users must create entirely new keypairs through a separate, maintained wallet application. The Foundation has suggested Nova Wallet as one possible alternative.

Changing a password, reinstalling Fearless Wallet or importing the same recovery phrase into another application cannot secure previously exposed credentials.

A similar requirement emerged after the Ill Bloom wallet flaw, where vulnerable recovery phrases remained unsafe even after users changed wallet software.

Polkadot users should also check assets held across other networks using the same compromised keys. Funds locked in staking, nomination pools or governance positions may require additional recovery steps before transfer.

The Foundation has directed users with inaccessible or staked assets toward PAPI Rescue, a recovery tool developed by the polkadot-api team.

Users who have suffered unauthorized withdrawals should preserve transaction hashes, wallet addresses and supporting evidence for possible law-enforcement investigations.

The Foundation has also warned against unsolicited recovery services and impersonated support accounts. Fearless Wallet remains an independently developed third-party application, and the investigation has not publicly established who introduced the malicious code or how many wallet credentials were ultimately exposed.

The post Polkadot Warns Fearless Wallet Extension Leaked Private Keys Since February 2025 appeared first on Crypto Adventure.