Fearless Wallet / Polkadot Community… · Disclosed

Fearless Wallet extension leaked private keys; Polkadot tells users to move funds

Feb 18, 2025 · 1 min read

Malicious code in Fearless Wallet Chrome extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 sent the user's private key to an attacker-controlled server each time the wallet was unlocked. According to the Polkadot Community Foundation notice of October 21, 2026, the code entered through a GitHub pull request on February 19, 2025 and the leak ran intermittently until at least October 10, 2026. There is no fixed version: users must generate new keypairs in a different wallet and move their funds.

By HIFY Radar newsroom Updated 10/26/2026 01:38 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedUnpatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Four versions of the Fearless Wallet Chrome extension (3.0.1, 3.0.3, 3.0.4 and 3.0.5) sent the user's private key to an attacker-controlled server each time the wallet was unlocked. The Polkadot Community Foundation published the security notice on October 21, 2026. The malicious code entered on February 19, 2025 through a GitHub pull request, and the leak ran intermittently until at least October 10, 2026.

Why it matters

Whoever holds the private key controls the wallet; updating the extension does not solve it, because the attacker keeps a working copy of the key. Eight users have already reported unauthorized transactions totaling 17,286 DOT, and the affected version still listed on the Chrome Web Store showed around 6,000 users. Potential exposure spans more than 19 months.

What to do

Treat every account that used the extension since February 2025 as compromised. Generate new keypairs in a different wallet and move funds immediately; Polkadot recommends Nova Wallet and points to PAPI Rescue for staked or locked funds. Beware recovery scams: Polkadot warns about opportunists posing as helpers who promise to retrieve funds.

For the technical team

Affected: Fearless Wallet / Polkadot Community Foundation Extensão Fearless Wallet (Chrome; build Firefox retirado da loja) · Fearless Wallet browser extension (Chrome): versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5. Firefox build delisted from the store. At the time of the notice, the Chrome Web Store still listed an affected version, with around 6,000 users.
Exploitation: Confirmed exploitation: eight users reported unauthorized transactions totaling 17,286 DOT (Polkadot Community Foundation, notice of 2026-10-21). Leak active intermittently from 2025-02-19 until at least 2026-10-10. Exposed accounts may exceed drained ones, since a leaked key can sit unused until the attacker strikes.
Fix: No fixed version. Mitigation: generate new keypairs in a different wallet (Polkadot recommendation: Nova Wallet) and transfer the funds. Staked or locked funds may require additional steps, such as the PAPI Rescue tool.
Vector: Malicious code in the extension build, introduced through a GitHub pull request tied to the TON ecosystem on 2025-02-19. When the user unlocked the wallet, the extension sent the private key to an attacker-controlled server. The exfiltration was intermittent, not continuous.
More details: Fearless Wallet is a third-party product; it has never been an official Polkadot wallet. Early user complaints describing similar problems after an update were logged as far back as October 2025; the detailed public explanation only came in October 2026. Polkadot warns of recovery scams exploiting the incident.