Polkadot (DOT) Community Foundation Warns of 20-Month Fearless Wallet Key Leak

Keys Copied From February 2025

The Polkadot (DOT) Community Foundation told anyone who used the Fearless Wallet browser extension at any point since February 19, 2025 to treat every account holding Polkadot (DOT) or any other asset in it as compromised and move the funds straight away. The warning, issued on October 21, 2026, follows the discovery of code inside the extension that copied private keys to an attacker-controlled server and remained active at intervals through October 10, 2026, a window of nearly 20 months. Four builds carried the code: 3.0.1, 3.0.3, 3.0.4 and 3.0.5. It activated when a user unlocked the wallet with the right password. A technical analysis linked in the notice describes the mechanism: the extension gathered each account's recovery phrase, the master seed of an HD wallet, or its backup file, together with the wallet password. It encrypted the bundle with an empty password, a step anyone can reverse, and uploaded the result to tonscanner.org. The code entered the project through GitHub pull request #1022, merged as part of a larger change titled “TON ecosystem” to the extension's public source. Versions 3.0.3 to 3.0.5 also read a configuration file in a separate public repository that worked as a remote on and off switch. The guidance is unconditional. A private key gives total control of an account, so changing a password or reinstalling the extension changes nothing; whoever holds the key can sign transfers and empty the balance. The foundation advised a fresh keypair in a different, well-maintained crypto wallet, with funds shifted off the old account on every chain it touched, ideally without unlocking Fearless again. It named Nova Wallet as one option for the new account. The Polkadot price stood at $1.17 as the notice circulated, up 3% over seven days and down 62.7% across the year.

Eight Reports, 17,286 DOT Unconfirmed

GitHub's public activity log records the remote switch as on during nine separate periods between March 7, 2025 and the October 10, 2026 endpoint, roughly 571 days in total. The code was removed from the project's source on June 25, 2026, yet installed copies of versions 3.0.3 to 3.0.5 still carry it. Each unlock makes those copies check the remote switch, which is off at present but can be switched back on. The foundation told users to shift the funds first, then uninstall the extension. The Firefox build ran the same code and is no longer listed; keys used in it inside the window should be treated as compromised too. The reviewed Android and iOS applications contain none of the code, though the notice adds that a private key ever present in the extension is compromised wherever that key is used. A browser extension is by construction a hot wallet, holding keys on an internet-connected device, and version 3.0.5 remained downloadable in Chrome's store with a user base of 6,000 on October 21. Eight users have come forward with unauthorized transfers that may be tied to the exploit, a reported total of 17,286 Polkadot (DOT); the case log states those reports do not prove theft. The first case is dated September 30, 2025; a Reddit post followed on October 6, 2025, with several users saying funds moved the moment they unlocked the wallet. Staked coins, nomination pool deposits and coins locked for governance cannot move immediately. Nominators face an unbonding period of one to two days at the shortest, and the notice directs users to PAPI Rescue, a tool from the polkadot-api team, ahead of any unstaking. Nobody, the foundation added, including the PAPI Rescue team, needs a user's private keys; anyone who messages first with an offer to recover funds is not legitimate. Fearless Wallet is built by an independent team and, the notice stated, is not and never was an official Polkadot wallet. The month is otherwise busy for the chain: the dotUSD stablecoin went live earlier in October, and the DAO primacy referendum over dotUSD is covered separately.

The Remote Switch Is Off, for Now

The exposure is permanent by design: a leaked private key cannot be rotated, only the funds moved away from it. What the record does not yet contain is scale. The foundation has published no count of affected accounts, and the 17,286 Polkadot (DOT) on file is reported rather than confirmed stolen. Two observations would change that picture, and the notice defines both: the remote switch flipping back on, or a fresh run of unlock-time transfers like the eight users described. Neither has been recorded since October 10, 2026. For keys that must stay offline after the migration, a cold wallet is the practical endpoint, and our Cypherock X1 walkthrough covers one such setup.