Fearless Wallet Extension Leaked Private Keys

The change that let it in had a harmless-sounding title: “TON ecosystem”. Inside it, according to the Polkadot Community Foundation, was code that waited for Fearless Wallet users to type their password and then sent their private keys to a server run by an attacker.

The foundation’s security notice, posted on the Polkadot Forum at 15:00 BST on 21 October, tells anyone who has used the Fearless Wallet browser extension since February 2025 to “assume that every account in it is compromised”. Fearless is a third-party wallet built by an independent team, and the foundation stresses that it “is not, and has never been, an official Polkadot wallet”. The case sits on TSN’s Crypto Hacks and Exploits hub.

In brief

Four versions of the Fearless Wallet browser extension sent users’ private keys to an attacker’s server when unlocked, the Polkadot Community Foundation says.
Anyone who used the extension since February 2025 should create new keys in another wallet and move funds; reinstalling or changing the password is not enough.
Eight users have reported losses totalling 17,286 DOT so far, the foundation says; who is behind the code, and how many people are exposed, is unknown.

The code sat in the public source for more than a year

According to the notice, versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the extension contained the offending code, which was added to its public source on 19 February 2025 as part of a large change. “The code was active at different times between February 2025 and 10 October 2026, and it could be enabled again at any point in time,” the foundation says. It has confirmed the behaviour in the Chrome version; the Firefox version was built from the same code but is no longer listed.

A technical analysis linked from the notice sets out the mechanism. On each successful unlock, the extension gathered the recovery phrase, or the account’s backup file with its password, for every main account. It encrypted them with an empty password, which anyone can reverse, and sent them to an outside server. In the later versions a configuration file in a separate public repository acted as a remote on-off switch. The analysis says the code was removed from the source on 25 June 2026 and the switch has been off since 10 October, but installed copies of 3.0.3 to 3.0.5 still check it every time they are unlocked.

The foundation says eight users have so far reported unauthorised transactions that could be linked to the exploit, totalling 17,286 DOT. Its log of reported cases runs from September 2025 to September 2026 and warns that it “is not the full extent of the problem”, since many affected users may not have noticed or reported anything. The wider exposure is unknown. The Defiant reported that on 21 October the Chrome Web Store still listed version 3.0.5 with about 6,000 users. That is a count of installs, not of victims.

New keys are the only fix

The point the notice makes most firmly is that the problem lies with the keys, not the app. Changing the password or reinstalling the extension “does not help”, it says, because the attacker may already hold the keys. Moving to another wallet only protects people who also create a new keypair there.

The foundation’s steps, in order:

Create a new keypair in a different, well-maintained wallet, not Fearless. It suggests Nova Wallet.
Move funds from the old account to the new one as soon as possible, checking every chain the old account uses, ideally through another wallet app rather than by unlocking Fearless again.
Fearless mobile users should switch to a maintained mobile wallet. If a device has been offline for a long time, keep it offline, export the keys and uninstall the app.
Staked funds, nomination pools and governance locks cannot be moved at once. Before unstaking, consider help from PAPI Rescue, built by the polkadot-api team, and never share private keys with anyone, including that team.
Once funds are safe, remove the extension.
Move funds from any other account that used the same keys.

The reviewed Android and iOS apps are free of the code, the notice says. But a recovery phrase that was ever loaded into the browser extension, for example by restoring a Fearless Google Drive backup, is compromised wherever it is now used.

Stopped staking can be the first warning sign

Victims did not always see their balance vanish first. The foundation lists signs to watch for: staking stopped or a stake starting to unbond, a changed reward destination, leaving a nomination pool or a removed governance vote, and small test transfers out of the account. Anyone who sees one should move what they can and contact PAPI Rescue. Those who have lost funds are told to keep transaction hashes, dates and amounts, report to SEAL 911 and consider a police report, which exchanges may ask for.

The notice also warns that “no one needs your private keys” and that Polkadot has no X support account, so unsolicited offers to recover funds should be ignored. The scam warning matters because thefts like this, including the NGRAVE wallet drain earlier this week, tend to attract fake recovery services. The open question is who controls the server and the switch. The analysis says it does not address who wrote the code or why, and until installed copies are removed, the code could be turned back on.