Polkadot’s Fearless Wallet Extension Leaked Private Keys, Exposing 17,286 DOT to Theft

The Polkadot Community Foundation warned on Oct. 21 that the Fearless Wallet browser extension had been leaking users’ private keys since February 2025. The breach, uncovered by the Polkadot Technical Fellowship, involved malicious code that extracted wallet credentials—recovery phrases, private keys and keystore files—when users unlocked their wallets, sending the data via HTTP to an external server. Eight users reported unauthorized transfers totaling 17,286 DOT. SlowMist identified the compromised extension versions as 3.0.1 and 3.0.3‑3.0.5. The attackers could toggle the malicious behavior remotely, making detection harder. Polkadot’s July 2025 network upgrade shortened the unbonding period for nominators from 28 days to 1–2 days, reducing the window for owners to recover compromised staking accounts before assets become transferable. The foundation urged affected users to generate new keypairs with a different wallet and move remaining funds immediately. Polkadot’s statement said, “If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible.”