Polkadot has issued an urgent security warning after investigators discovered that multiple versions of the Fearless Wallet browser extension were secretly transmitting users' private keys to an attacker-controlled server, with the compromise dating back to February 2025.

The Polkadot Community Foundation disclosed the vulnerability in a security notice published on October 21, 2026, identifying versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 as affected. Eight users have reported unauthorized transactions potentially linked to the incident, together involving 17,286 DOT.

Anyone who used the extension at any point since February 2025 has been instructed to abandon their existing wallet keys, generate new credentials through a different wallet application, and move any remaining assets immediately.

Malicious Code Persisted in the Extension for More Than a Year

The malicious functionality entered Fearless Wallet's public GitHub repository on February 19, 2025, through a large code change titled “TON ecosystem”. The change remained publicly viewable for more than 16 months before its removal — a span that shows how long concealed credential-handling logic can persist in code that is technically open to public audit.

The technical investigation, detailed in two HackMD reports (first, second), identified functionality that extracted recovery phrases or account keystore files, together with wallet passwords, whenever users successfully unlocked the extension. The stolen information was encrypted using an empty password — a protection that is trivially reversible — before being transmitted to an external server.

Later introduced a remotely controlled configuration mechanism capable of switching the malicious behavior on or off. The code was removed from the public repository on June 25, 2026, but it remained embedded in installed extension versions 3.0.3 through 3.0.5.

That remote mechanism stayed active during multiple periods through October 10, 2026. Because previously installed copies can still reactivate the functionality, users remain exposed even after the latest identified transmission window ended.

The incident resembles the earlier Trust Wallet extension breach, which involved malicious browser-extension code capable of exposing wallet recovery credentials.

Eight Users Report Unauthorized DOT Transfers

The Foundation's October 21 warning identified eight reported cases involving 17,286 DOT, although its accompanying public transaction records separately total 15,571.99 DOT and 54,450.36 DED. The difference between the DOT figures has not been explained.

Reported incidents occurred between September 2025 and September 2026, with the largest documented case involving approximately 8,996 DOT transferred from a single wallet on September 23.

The investigation confirmed the malicious functionality in the Chrome extension. Firefox used the same source code, although its published extension packages were unavailable for inspection. That gap leaves the extent of Firefox-user exposure undetermined. Reviewed Android and iOS applications did not contain the malicious code. However, mobile users who previously imported recovery credentials into the affected browser extension remain exposed.

Unlike the recent Qubic wallet exploit, which involved predictable wallet seeds, the Fearless Wallet vulnerability transmitted existing recovery credentials directly to an external destination.

Polkadot Urges Immediate Wallet Migration

Affected users must create entirely new keypairs through a separate, maintained wallet application. The Foundation has suggested Nova Wallet as one possible alternative.

Changing a password, reinstalling Fearless Wallet, or importing the same recovery phrase into another application cannot secure previously exposed credentials. A similar requirement emerged after the Ill Bloom wallet flaw, where vulnerable recovery phrases remained unsafe even after users changed wallet software.

Polkadot users should also check assets held across other networks that use the same compromised keys. Funds locked in staking, nomination pools, or governance positions may require additional recovery steps before they can be transferred.

For users with inaccessible or staked assets, the Foundation has pointed to PAPI Rescue, a recovery tool developed by the polkadot-api team.

Users who have suffered unauthorized withdrawals should preserve transaction hashes, wallet addresses, and supporting evidence for possible law-enforcement investigations. The Foundation has also warned against unsolicited recovery services and impersonated support accounts.

Fearless Wallet remains an independently developed third-party application, and the investigation has not publicly established who introduced the malicious code or how many wallet credentials were ultimately exposed. Those unanswered questions, along with the discrepancy between the reported DOT totals, are the main points to watch in any subsequent updates from the Foundation.