Users Report 17,286 DOT in Unauthorized Transfers After Fearless Wallet Key Leak
Key Facts
The Polkadot Community Foundation said in a security alert that 8 users had reported unauthorized transfers totaling 17,286 DOT attributable to an exploit of the Fearless Wallet browser extension. It said malicious code leaked private keys, which give their holder control over the transactions permitted by the account. The warning covered extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5. According to the foundation, the code was active intermittently between February 2025 and 10 October 2026. It warned that exposed keys remain at risk even after a password change or reinstallation of the extension.
The alert traced the introduction of the code into the extension's public source code to 19 February 2025, as part of a change titled "TON Ecosystem." The leak mechanism was tied to unlocking the wallet, which triggered the transmission of the private key to an attacker-controlled server. Describing what happened, the foundation said: "When you unlocked the wallet, it sent your private key." It said the code operated intermittently during the period covered by the warning and could be reactivated. The danger of leaking this key, according to Polkadot developer documentation, is that it grants full control over all transactions permitted by the user's account on the network.
The foundation confirmed that the Chrome browser extension was infected, while the Firefox extension used the same code. It therefore advised Firefox users to treat their keys as exposed as well. The foundation said the Android and iOS versions reviewed did not contain the code in question. However, using a phone does not eliminate the risk to a key previously used in the affected browser extension. The warning therefore extends to users who move the same key to the mobile app, because its previous exposure persists regardless of whether the reviewed app is free of the code responsible for the leak.
Fearless describes its product as a self-custody wallet controlled by the user through their recovery phrase. The company says on its website: "Fearless Wallet does not hold your funds," explaining that control of the wallet is tied to the recovery phrase. It advertises support for more than 80 networks and a user base exceeding 250 thousand for the wallet as a whole. The company's roadmap includes unifying the browser extension and the mobile apps around a shared recovery phrase. The plan also calls for keeping legacy wallets available for export and recovery, while new versions use the unified wallet by default.
To address the exposure, the foundation recommended creating new keys outside Fearless Wallet and moving assets to the new account. It stressed that changing a password does not protect keys that have already been leaked. The same warning applies to reinstalling the browser extension, which does not remedy the key's exposure. Keys previously used in the extension also remain at risk when subsequently used on a phone. The recommendation to move assets calls for an account with new keys, rather than continued use of the exposed key through another wallet app.
Papi Rescue says its assistance process is limited to cases in which funds have not yet left the wallet. Its scope covers assets remaining in the wallet that can be recovered and does not include recovering funds already transferred out. According to the service, its team reviews the details of each case to determine its suitability and assess whether the assets appear recoverable. An assessment is provided after this review, and submitting a request does not guarantee asset recovery. The service asks applicants not to include recovery phrases, private keys or any other confidential material in assessment requests.