Timeline
- 7.5
polkadotfoundationwarnsfearlesswalletextensionleakedprivatekeys
The Polkadot Foundation issued a warning that the Fearless Wallet browser extension leaked users' private keys, leaving affected wallets exposed to compromise. The warning names the third-party Polkadot-ecosystem wallet directly. Private keys are what authorize transfers from a wallet, so anyone holding a leaked key can move the associated funds without further approval from the owner. Fearless Wallet's browser extension is built for the Kusama and Polkadot networks and distributed through the Chrome Web Store for Chrome and Chromium-based browsers. The warning as reported did not include confirmed loss figures, exploit scale, or the number of affected users.
- 8.0
Polkadot Community Foundation: Fearless Wallet browser extension contains code that leaks private keys, users must move assets immediately
The Polkadot Community Foundation posted a security warning on the Polkadot forum stating that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of Fearless Wallet's browser extension contain malicious code that sends users' private keys to attacker-controlled servers when the wallet is unlocked. The code entered the extension's public source in a large commit labeled "TON ecosystem" on February 19, 2025, activated intermittently between February 2025 and October 10, 2026, and can reportedly be reactivated at any time. The Foundation advises that anyone who used the extension since February 2025 treat every account in it as compromised, generate new key pairs in another wallet and move assets immediately, noting that changing the password or reinstalling the extension is not sufficient. Eight users have so far reported unauthorized transactions attributable to the incident, totaling 17,286 DOT. The Chrome version is confirmed affected, and a delisted Firefox version used the same code; no such code was found in the Android or iOS mobile apps, though any private key previously imported into the browser extension should still be considered leaked. Users whose assets are staked, in nomination pools, or locked in governance votes can first seek help through PAPI Rescue, a tool developed by the polkadot-api team.