Browser wallet extension leaking encrypted key material into a dark network conduit

Fearless Wallet Leak Exposed Polkadot Keys for Nearly 20 Months

By Isaac • October 25, 2026 7:11 am • Comments

A browser extension used to manage Polkadot assets was quietly exposing private keys for roughly 20 months, turning an ordinary wallet unlock into a potential handoff to an attacker-controlled server.

The Polkadot Community Foundation’s security notice says the affected product was the Fearless Wallet browser extension, a third-party application that has never been an official Polkadot wallet. An investigation by the Polkadot Technical Fellowship found that unlocking the extension could trigger the private-key transfer.

The reviewed Chrome versions were 3.0.1, 3.0.3, 3.0.4 and 3.0.5. The Firefox extension used the same code and is no longer listed.

Trending: Block’s Human-Sounding AI Voice Raises a New Crypto Scam Question

The warning is unusually severe because this went beyond a password leak. When users unlocked the affected extension, code could send the underlying private key to infrastructure controlled by the attacker.

Once that secret has left the device, deleting the extension, reinstalling it or changing a local password cannot pull it back. The only durable remedy is a fresh key pair created in different wallet software, followed by a transfer to the new address.

The foundation traced the exposure window from February 2025 through October 10, 2026 and said the malicious behavior could be controlled remotely. Eight users had reported unauthorized transactions totaling 17,286 DOT by the time of the notice.

The reviewed Android and iOS apps did not contain the same code. Users of the browser extension, however, were told to create entirely new keys and move their funds rather than simply update the software.

The affected window stretched from February 2025 into October 2026

According to the foundation, the malicious behavior could be switched on remotely and was active at different points from February 2025 through October 10, 2026.

The source code was cleaned earlier, but already-installed extension builds could continue checking the remote switch. That gap is what made the exposure last far longer than a normal bad release.

Eight users had reported unauthorized transactions tied to the incident when the notice was published, totaling 17,286 DOT. That count covers reported losses, not every exposed wallet.

A copied key can remain unused while an attacker waits for a balance to grow, for staked funds to unlock or for the owner to become less vigilant.

CryptoSlate’s review of the incident highlighted that timing problem: faster access to funds can improve the user experience, but it can also shorten the window available to rescue assets after a key compromise becomes public.

What Fearless extension users need to do

The foundation’s direction is clear: anyone who used the browser extension during the affected period should treat every account loaded into it as compromised. The safe response is to create a fresh key pair in a different wallet and transfer available assets to the new address.

Users with bonded or staked DOT may not be able to move everything immediately. They should begin the unlocking process, move any liquid balance now and monitor the compromised address until the remaining funds can be transferred.

The new wallet must use a genuinely new recovery phrase; importing the old phrase into different software only places the same exposed key behind a new interface.

The foundation said the reviewed Android and iOS versions did not contain the malicious code. That distinction matters: this warning is about the browser extension, not every Fearless product and not the Polkadot network itself.

The bigger lesson is about update trust

Self-custody removes an exchange from the custody chain, but it does not remove software risk. A wallet extension sits close enough to the private key that one malicious update, compromised maintainer or hidden remote switch can defeat everything the user does right.

That makes provenance and update control part of custody. Users should know who maintains a wallet, whether releases are reproducible, how quickly the ecosystem can revoke a compromised build and whether the wallet exposes high-value keys to an always-connected browser at all.

For affected Fearless extension users, the debate can wait. The old key should be considered burned.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews