Polkadot issues urgent warning on Fearless Wallet breach

6.6 Security

Oct 21, 2026

Polkadot warns Fearless Wallet extension users of a 20-month private key leak. Four versions sent keys to an attacker, with at least 17,286 DOT stolen. Users are urged to move funds immediately.

The Polkadot Community Foundation has issued an urgent warning to users of the Fearless Wallet browser extension. Anyone who used the extension since February 19, 2025, should consider all accounts compromised and move their funds immediately. Four versions—3.0.1, 3.0.3, 3.0.4, and 3.0.5—contained malicious code that sent users’ private keys, recovery phrases, and wallet passwords to an attacker-controlled server whenever the wallet was unlocked. This vulnerability lasted about 20 months and affected both Chrome and Firefox versions. It was introduced via a GitHub pull request related to the TON ecosystem. At least eight users have reported unauthorized transfers totaling 17,286 DOT. The Android and iOS apps were reviewed and found safe. The foundation urges users to generate new keys and transfer assets to secure wallets, as any private key stored in the compromised extension is at risk.