The Polkadot Community Foundation told Fearless Wallet browser-extension users to create new keys and move their funds. Four extension versions contained code that sent private keys to an attacker's server. Fearless is a third-party app, not an official Polkadot wallet.
The Polkadot Community Foundation urged Fearless Wallet browser-extension users on Oct. 21 to create new keys and move their funds. It said four versions contained code that sent private keys to an attacker's server when the wallet was unlocked. According to the foundation's security notice: "assume that every account in it is compromised" for anyone who has used the extension since February 2025.
Four extension versions carried the code
The notice identifies versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5. It says the code entered the public repository on Feb. 19, 2025, in a change titled "TON ecosystem," and was active at different times between February 2025 and Oct. 10, 2026. The foundation stressed that Fearless is a third-party application, not an official Polkadot wallet.
On Oct. 21, the Chrome Web Store still offered version 3.0.5 with 6,000 users. That is a store user count, not a count of compromised accounts, and the notice does not quantify the total exposed population.
Reported losses
The notice cites eight users reporting unauthorized transactions that it says could be linked to the exploit. Crypto Briefing put the total at 17,286 DOT. A linked case log cautions that matching transactions onchain does not establish how each account's keys were exposed.
What users are told to do
The foundation says changing a password, reinstalling the extension or importing the same recovery phrase into another app does not secure an exposed account. Users should create a fresh keypair in a different wallet and transfer funds across every chain where the old keys were used.
Reviewed Android and iOS versions did not contain the code, according to the notice. Any private key previously used in the browser extension should still be treated as compromised, including on mobile.
For funds in staking or locked in governance, the notice recommends seeking help from PAPI Rescue before unstaking. It also warns users to ignore unsolicited recovery offers.
Sources: The Defiant, Crypto Briefing
Trading involves risk.
Risk Disclaimer
