Fearless Wallet Extension Leaked Keys for 20 Months, 17,286 DOT Lost

The Polkadot Community Foundation warned on October 21, 2026 that four versions of the Fearless Wallet browser extension sent a copy of the user's private key to an attacker-controlled server whenever the wallet was unlocked. Eight users have reported unauthorized transfers totaling 17,286 DOT, which CryptoTicker valued at about $20,000 at the time of disclosure.

Details

The affected releases are 3.0.1, 3.0.3, 3.0.4 and 3.0.5. According to CryptoSlate and CryptoTicker, the malicious code entered the project through a GitHub pull request on February 19, 2025, and was active intermittently until at least October 10, 2026. Version 3.0.5 was still listed on the Chrome Web Store, with roughly 6,000 users. The Firefox build carried the same code.

Cryptopolitan reports the extension collected recovery phrases and passwords, "encrypted" them with an empty password and sent them to an external server. Complaints about thefts surfaced on the Polkadot forum as early as October 6, 2025, when support said no vulnerability had been confirmed.

The foundation stresses that Fearless Wallet is a third-party product, not an official Polkadot wallet. Anyone who used the affected versions should treat their accounts as compromised, generate new keys in a different wallet (the foundation points to Nova Wallet), move their funds and remove the extension. Changing the password does not protect a leaked key.

What it means for the market

The reported loss is small by hack standards, but the case is a supply-chain warning: malicious code sat in a public project for about a year and a half. For the live price see the daily brief; the coin has its own Polkadot page.

The number of victims could be higher than eight. About 6,000 installs is not the same as confirmed thefts, and a leaked key leaves no trace until funds are moved.