Security notice: Fearless Wallet browser extension - leaked private keys

Ecosystem
1

If you have used the Fearless Wallet browser extension since February 2025, assume that every account in it is compromised. You should generate a new private key outside of Fearless Wallet and move your funds to the new account now.

Fearless Wallet is a third-party application, built and maintained by an independent team. It is not, and has never been, an official Polkadot wallet.

Beware of scams. No legitimate person will message you offering to recover your funds, and no one needs your private keys. Polkadot does not have an X support account.
As a rule of thumb, ignore direct messages from “recovery agents, customer support or any such accounts”.

What happened

Versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the Fearless Wallet browser extension contained offending code. Added to the extension’s public source code on 19 February 2025, as part of a large change titled “TON ecosystem” (PR on GitHub). When you unlocked the wallet, it sent your private key to a server run by the attacker. The code was active at different times between February 2025 and 10 October 2026, and it could be enabled again at any point in time.
Please, find a more detailed explanation about the behaviour of the source code found here.

This is confirmed for the Chrome version. The Firefox version used the same code but is no longer listed; however, if you used the Firefox extension during that window, please consider the keys compromised.

If you believe you are impacted, please see the suggested action steps below and act in a timely manner.

So far, eight users have reported unauthorised transactions that could be attributed to this exploit, totalling 17,286 DOT. Find the individual reports here.

Are you affected?

  • You used the Fearless browser extension at any time since February 2025: yes. Treat every account that was in it as compromised.
  • You only use the Fearless mobile app: the reviewed Android and iOS versions do not contain this code. However, if the same private key was ever in the browser extension (for example, after restoring a Fearless Google Drive backup into it), that phrase is compromised wherever you use it.
  • You have already moved to another wallet app: that only protects you if you also created a new keypair.
  • An account is controlled by its seed phrase, not the app used.
    If the seed phrase is compromised, the account is compromised regardless of the wallet used.

Changing your password or reinstalling the extension does not help. The attacker may already have your keys.

What to do now

  1. Create a new keypair in a different well-maintained wallet, (we suggest Nova Wallet) - not Fearless. Remember to be diligent about your wallet of choice. And if possible keep it offline.
  2. Move your funds from the old account to the new one as soon as possible. Check every chain the old account uses. If you can, operate via another wallet app with your private key, rather than unlocking the Fearless extension again.
  3. If you are a Fearless mobile user, we strongly recommend transitioning to a well-maintained mobile wallet. In case your device is offline and hasn’t been used in a long time, keep it offline, export the private keys and then uninstall the unmaintained wallet app.
  4. If your funds are staked, in a nomination pool or locked in a governance vote, they cannot be moved straight away. In other cases, users reported the funds were transferred without action on their part the moment they unlocked. Remember that on Polkadot, nominators can unbond as fast as 1 or 2 days.
    Before you start unstaking, consider getting help from PAPI Rescue, built by the polkadot-api team, which helps recover funds that are still in a compromised account. Never share your private keys with anyone, including the PAPI Rescue Team.
  5. Once your funds are safe, remove the extension. The offending code is still in installed copies of versions 3.0.3 to 3.0.5, and it could be switched on again.
  6. If you used the same private keys anywhere else, move those funds too.

Warning signs

Your account may be under attack if you see any of these and did not do it yourself:

  • your staking was stopped, or your stake started unbonding;
  • your staking reward destination changed;
  • you left a nomination pool, or a governance vote was removed;
  • small test transfers left your account.
  • any other on-chain action you haven’t done yourself.

If you see one, move whatever you can immediately and contact PAPI Rescue.

If you have lost funds

  • Preserve evidence: having information such as account address, the unauthorised transaction hashes, dates and amounts could be useful for you in the future in case you decide to take any action.
  • You can report it to SEAL 911.
  • Remember, you can file a police report about it. It will most likely be needed if you interact with centralised exchanges that may have received your funds.
  • Beware of scams. No legitimate person will message you first offering to recover your funds, and no one needs your private keys. As a rule of thumb, ignore direct messages from “recovery agents”.

This update is provided by the Polkadot Community Foundation for informational purposes only. It is not financial, investment, legal, accounting, or tax advice, and nothing in it constitutes an offer to sell or a solicitation to buy any token, security, or other financial instrument. This statement does not constitute a statement,commitment, or obligation of the Polkadot Community Foundation or of any third party referenced in this or prior communications. References to third parties do not imply their endorsement. Digital assets are volatile and involve significant risk, including the possible loss of the entire value of your holdings.

7 Likes