SECURITY ALERT

The wallet asked for a password.

Then it sent the key somewhere else.

Users of four releases of the Fearless Wallet browser extension had their private keys sent to an attacker-controlled server each time they unlocked the wallet, the Polkadot Community Foundation said on Wednesday, in a security notice posted at 14:00 UTC.

The affected versions are 3.0.1, 3.0.3, 3.0.4 and 3.0.5.

Anyone who used the extension at any point since February 2025 should treat every account in it as compromised, the foundation said.

Fearless Wallet is a third-party app built by an independent team. The foundation says it is not, and never was, an official Polkadot wallet.

What the notice says

  • 19 Feb 2025. The offending code enters the extension’s public source code as part of a large change titled “TON ecosystem”, according to the foundation.
  • February 2025 to 10 Oct 2026. The code is active at different times. It could be switched on again at any point, the foundation says.
  • 21 Oct 2026, 14:00 UTC. The foundation publishes the notice.

The foundation has confirmed the behaviour in the Chrome extension. The Firefox edition, which has since been delisted, shared the same code.

So far eight users have come forward with unexplained transfers that may trace back to the leak, together worth 17,286 DOT, according to the foundation. That is about $20,200 at CoinGecko’s price of $1.17 at 20:14 UTC.

Those are reported losses. CryptoWatchDesk has not reconciled them on-chain.

A private key is the secret that signs transactions; whoever holds it controls the account, whatever app it sits in. A new password or a fresh install of the extension will not fix that.

So how many keys left before anyone noticed?

Who is exposed

The foundation says the reviewed Android and iOS apps do not contain the code.

That protects a phone user only if the same key never sat in the extension. A key restored into the extension from a backup counts as compromised wherever it is used.

Moving to another wallet app is not enough either. The account is the key, not the app.

If the key is still the old one, what has really changed?

Protect yourself

  • Create a new key in a different, maintained wallet and move funds to it now, on every chain the old account used. The foundation suggests Nova Wallet.
  • Staked, pooled or governance-locked DOT cannot move at once. On Polkadot, unbonding can take one to two days; the foundation points users to PAPI Rescue, built by the polkadot-api team, before they start.
  • Watch for actions you did not take: stopped staking, a changed reward destination, a removed vote, small test transfers out.
  • Remove the extension once funds are safe. Installed copies of 3.0.3 to 3.0.5 still carry the code.
  • No one needs your key. Ignore any direct message offering recovery; victims can report to SEAL 911 and the police.

For the basics, see what a private key is. It follows Qubic’s weak-seed reclaim this week and the fake Coldcard firmware warning earlier this month.

How long can a wallet extension ship a stranger’s code before someone reads it?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.