Reports of 17,286 DOT transferred without authorization after Fearless Wallet key leak

Key Facts

The Polkadot Community Foundation said in a security alert that 8 users had reported unauthorized transactions totaling 17,286 DOT as of the alert's publication, potentially attributable to an exploit involving the Fearless Wallet browser extension. The foundation said the extension contained code that leaked the private key when the wallet was unlocked. The key was sent to a server operated by the attacker, according to its description of the leak mechanism. Addressing users in its explanation of what happened, the foundation said the extension "sent your private key" when unlocked. Fearless is an independent third-party application, not an official Polkadot wallet.

According to the foundation, the code responsible for the leak was added to the extension's public source code on 19 February 2025. The addition was part of a change titled "TON Ecosystem". The foundation said the code was active at various times between February 2025 and 10 October 2026, with the possibility of reactivation remaining. The alert identified extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 as containing the malicious code. It confirmed the issue in the Chrome version, while the Firefox version used the same code despite no longer being listed, prompting it to recommend that Firefox users also treat their keys as exposed.

As for the Android and iOS versions examined, the foundation said they "do not contain this code". But the warning covers accounts whose keys were previously used in the browser extension, wherever those keys were subsequently used. The official Fearless website allows users to create or import a recovery phrase and use it across the mobile apps and browser extension. The same recovery phrase can therefore be used in the mobile versions examined and in the browser extension covered by the alert. The foundation stressed that switching to another wallet application with the same exposed key does not secure the account.

As part of its response guidance, the foundation recommended creating a new key pair in another wallet and transferring assets to it across all networks used. The alert listed small test transfers, or the initiation of unstaking and changes to reward destinations without the account holder's involvement, among the warning signs. For assets still in the exposed account, the "Papi Rescue" service says its assistance is limited to assets recoverable in place. The service covers assets subject to network locks. It does not, however, trace or recover funds once they have moved out of the wallet, according to its stated terms.