Polkadot Community Foundation Warns Fearless Wallet Users of Exposed Keys

Polkadot Community Foundation warned that certain Fearless Wallet browser extensions may have exposed private keys, urging users who used them since February 2025 to move funds to accounts with newly generated keys.

The affected versions are 3.0.1, 3.0.3, 3.0.4 and 3.0.5. The foundation said the extension contained code added to its public source code on Feb. 19, 2025, that could send a wallet's private key to an attacker-controlled server when unlocked. It said the code operated intermittently from February 2025 through Oct. 10, 2026, and could be reactivated at any time.

Eight users have reported unauthorized transactions tied to the incident, totaling 17,286 DOT. The foundation said Chrome extensions were confirmed affected and a Firefox version that has since been removed contained the same code. It found no such code in the Android or iOS apps, but said keys previously imported into the browser extension should be treated as exposed.

Users should create new key pairs in another wallet and transfer their assets; changing a password or reinstalling the extension will not secure exposed keys. Funds locked in staking, nomination pools or governance voting may be recoverable with PAPI Rescue, a tool developed by the Polkadot API team.

Fearless Wallet is maintained by an independent team and is not Polkadot's official wallet.