The Polkadot Community Foundation issued a security warning on October 21, 2026: the Fearless Wallet browser extension contained hidden code that sent users’ wallet secrets to a server controlled by attackers. Anyone who used the extension since February 2025 should treat their accounts as compromised and move their funds to new keys right away.
Fearless Wallet is an independent, third-party wallet. It has never been an official Polkadot wallet.
Which versions are affected
Versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the browser extension. The problem was confirmed in the Chrome version; the Firefox version uses the same code, so it should be treated as affected too.
The Android and iOS apps were reviewed and do not contain the code. But if you ever imported the same recovery phrase into the browser extension, those accounts are exposed as well, wherever you use them.
What the code did
Each time a user unlocked the wallet, the extension quietly collected the recovery phrase or keystore file, together with the wallet password, and sent them to an outside server. The data was “encrypted” with an empty password, so it offered no real protection.
Later versions could switch this behavior on and off remotely, through a settings file loaded from a separate GitHub repository. That means copies already installed could start leaking again at any time.
Timeline
- February 19, 2025: the malicious code enters the project’s public code, hidden in a large update labeled “TON ecosystem”. Who added it has not been established.
- September 2025 – September 2026: unauthorized transfers are reported. User complaints about problems after updates appeared as early as October 2025.
- June 25, 2026: the code is removed from the public source, but installed copies of versions 3.0.3 to 3.0.5 keep it.
- October 10, 2026: the last period in which the remote switch was found active.
- October 21, 2026: public warning from the Polkadot Community Foundation.
How much was lost
Eight users reported unauthorized transactions totaling 17,286 DOT. The largest single case was about 8,996 DOT, moved on September 23. The Foundation’s public transaction log lists 15,571.99 DOT plus 54,450.36 DED (a Polkadot meme token); the gap between the two DOT figures has not been explained.
The real number of victims may be higher. A stolen key can sit unused for months before the attacker empties the wallet, and investigators have found more suspicious accounts. When the warning was issued, the Chrome Web Store listing for one affected version showed about 6,000 users.
What to do if you used Fearless Wallet
- Create a brand-new wallet (new keys, new recovery phrase) in another, actively maintained wallet app. Polkadot pointed to Nova Wallet as one option.
- Move all your funds from every affected account to the new wallet, on every network where you used the same keys.
- Don’t rely on half-measures. Changing the password, updating or reinstalling Fearless Wallet, or importing the old recovery phrase into another wallet does not make the funds safe, because the attacker may already have the keys.
- Staked or locked funds (staking, nomination pools, governance) may need extra steps. The Foundation points to the PAPI Rescue tool for these cases.
- Keep evidence: transaction hashes and wallet addresses, in case you report the theft to the police.
Beware of “recovery” scams
Hacks like this attract scammers posing as support staff or fund-recovery services. No legitimate helper, including the PAPI Rescue team, will ever ask for your private keys or recovery phrase, and nobody genuine will message you first offering to get your money back.
Why it matters
This is a supply-chain attack: the wallet itself was the threat. It’s a reminder that browser-extension wallets are only as safe as the code inside them, and that large sums are better kept on a hardware wallet, where the keys never touch your computer.
This article is for information only and is not financial advice.
