Polkadot tells Fearless Wallet extension users to move funds after a 20-month key leak

The Polkadot Community Foundation warned anyone who used the Fearless Wallet browser extension since February 2025 to consider all the accounts in the extension compromised and move their funds straightaway.

On February 19, 2025, code was added that sent private keys to an attacker’s server and ran at varying times until October 10, 2026.

Four builds shipped recovery phrases to tonscanner.org

The code was carried in four builds: 3.0.1, 3.0.3, 3.0.4, and 3.0.5. According to the foundation’s October 21 security notice, it was activated by an unlock with the right password.

A technical analysis linked in the notice says the extension gathered the recovery phrase of each account or its backup file and wallet password. It encrypted them with an empty password (which is reversible by anyone) and shipped them to tonscanner.org.

A private key has total control over an account. Even changing a password or reinstalling the extension doesn’t help, as anyone with one can sign transfers and empty the balance, the foundation said.

The Firefox build was running the same code and is no longer listed. And if someone used it in the window, those keys should be considered compromised too.

The code is absent from the reviewed Android and iOS apps. But any private key that was in the extension at any point is compromised wherever it’s used, the notice said.

The code was merged from GitHub pull request #1022 as part of a sizable change called “TON ecosystem” to the public source of the extension. Versions 3.0.3 – 3.0.5 used a config file in a separate public repo as a remote on/off switch.

The switch is recorded as on in the activity log on GitHub for nine periods between March 7, 2025, and October 10, 2026. In all, it was about 571 days.

The code was removed from the project’s source on June 25, 2026, but installed copies of versions 3.0.3 to 3.0.5 still carry it. Each time the wallet is unlocked, they check a remote switch that is off for now but could be turned back on. The foundation told users to move their funds first and uninstall the extension after.

Eight users report 17,286 DOT in unauthorized transfers

The foundation said eight users have reported unauthorized transactions possibly linked to the exploit, totaling 17,286 DOT. Its case log says the reports don’t prove anything was stolen.

The first case in the log is September 30, 2025, with a Reddit post on October 6, 2025. Some users said the funds moved as soon as they unlocked the wallet without any action on their part.

Version 3.0.5 was still in the Chrome Web Store with 6,000 users on October 21.

Fearless Wallet is a third-party app developed by an independent team. The foundation said it is not, and never was, an official Polkadot wallet.

Its advice is a new keypair in a different and well-maintained wallet. It suggests Nova Wallet.

Funds need to be shifted off the old account on each chain it was used on, ideally without unlocking Fearless again.

Staked coins, nomination pool deposits, and locked coins for governance can’t move right away. Polkadot nominators can unbond in as little as one to two days. The announcement steers users to PAPI Rescue, built by the polkadot-api team, ahead of unstaking.

The foundation said that no one, including the PAPI Rescue team, needs a user’s private keys. It warned that no legitimate person will message first, offering to recover funds.

Earlier this month, Polkadot’s dotUSD stablecoin went live.

At the time of writing, DOT is trading at $1.17 with 3% gains in the past seven days. The token lost 62.7% of its value in one year.

If you're reading this, you’re already ahead. Stay there with our newsletter.