Fearless Wallet Users Warned of Exposed Private Keys
Malicious code in browser extensions allowed unauthorized transfers of 17,286 DOT, forcing users to secure their accounts.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Do you trust browser extensions to manage your private keys and digital assets?
The Polkadot Community Foundation has issued a warning regarding compromised private keys in specific browser extension versions of Fearless Wallet. Malicious code embedded in these versions allowed unauthorized access to user wallets, resulting in the theft of 17,286 DOT from eight confirmed users.
Why it matters
This incident highlights the security risks inherent in browser-based cryptocurrency wallets, where malicious code can silently exfiltrate private keys when a wallet is unlocked. It underscores the importance of securing assets in cold storage or hardware-backed solutions to mitigate risks from software-level vulnerabilities.
The vulnerability affected Fearless Wallet browser extension versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5. The malicious code, which could transmit private keys to an attacker-controlled server upon unlocking the extension, was present in the source code starting February 19, 2025.
The players
Polkadot Community Foundation
An organization focused on the development and security of the Polkadot blockchain ecosystem.
Fearless Wallet
A non-custodial cryptocurrency wallet application designed for the Polkadot and Kusama networks.
The details
The malicious code operated by intercepting the user's private key the moment the wallet was unlocked within the browser environment. By hooking into the extension's internal state, the code sent the decrypted key to a remote, attacker-controlled server. Users who held funds in staking, nomination pools, or governance voting may be able to recover these locked assets using the PAPI Rescue tool, a recovery utility designed for Polkadot-based accounts.
Timeline
February 19, 2025: Malicious code was added to the public source code.
February 2025: The malicious code began operating within the extensions.
October 10, 2026: The malicious code ceased operating.
The Tech Race
This breach follows a pattern similar to the 2023 Ledger Connect Kit supply chain attack, where malicious code was injected into legitimate software libraries to steal assets. It demonstrates the continued challenge of ensuring the integrity of browser-based wallet extensions in the broader blockchain ecosystem.
Users of Fearless Wallet browser extensions should treat all private keys imported into versions 3.0.1 through 3.0.5 as permanently compromised. Those with assets currently locked in staking or governance may utilize the PAPI Rescue tool to attempt fund recovery.
The takeaway
Users must assume that any private key handled by these specific extension versions has been exposed and should rotate their keys or move funds immediately. Monitor for future updates from the Polkadot Community Foundation regarding potential further recovery mechanisms or additional affected software versions.
Further reading
For broader context on digital asset protection and threat intelligence, see our Cybersecurity section.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust browser extensions to manage your private keys and digital assets?
