Fearless Wallet Security Review: Private Key Exposure in Polkadot Browser Extension After 20-Month Flaw
In short
Fearless Wallet browser extension leaked private keys via malicious code active from February 2025 through October 2026, affecting users across multiple versions.
Fearless Wallet security review centers on a documented compromise in its Polkadot browser extension. Malicious code in versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 exfiltrated recovery phrases and private keys to an attacker-controlled server when users unlocked their wallets.
The extension is a third-party tool, not an official Polkadot product. The Polkadot Community Foundation issued a notice on October 21, 2026, confirming the issue and directing affected users to treat accounts as compromised.
Fearless Wallet review: Timeline of the 20-Month Vulnerability
The malicious code entered the public GitHub repository on February 19, 2025, through a pull request labeled as TON ecosystem support. It remained active intermittently until at least October 10, 2026. Developers removed the code from the source repository on June 25, 2026, yet installed extensions continued to receive remote configuration updates that kept the exfiltration active.
Earlier user reports of unauthorized transactions appeared in October 2025 forum posts, months before the official disclosure. At the time of the notice, the extension had roughly 6,000 users. Version 3.0.5 stayed listed in the Chrome Web Store after the announcement.
The affected browser extension collected recovery phrases, keystore files, and passwords on unlock or account import. Data was encrypted with an empty password and transmitted via HTTP. The same code path existed in the Firefox version before it was unlisted.
Impact on Users and Confirmed Losses
Eight users reported unauthorized transactions totaling 17,286 DOT linked to the exploit. Any account whose seed phrase or keystore ever passed through the compromised extension versions must be considered exposed, even if later moved to another device or wallet.
Mobile versions of Fearless Wallet for Android and iOS did not contain the malicious code. However, keys previously used in the browser extension remain at risk regardless of current storage location.
| Version | Status | Key Exposure Risk |
|---|---|---|
| 3.0.1 | Compromised | High - code present |
| 3.0.3–3.0.5 | Compromised | High - remote config enabled |
| Mobile apps | Clean | Low unless prior browser use |
Users who imported the same seed into another wallet or changed passwords receive no protection. The only effective step is creation of entirely new keypairs in a maintained wallet such as Nova Wallet, followed by immediate transfer of all assets across every connected chain.
Steps Users Should Take After the Breach
Anyone who used the extension since February 2025 should generate fresh keys outside the affected software. Funds must be moved promptly using tools such as PAPI Rescue for any locked or staked positions. Reinstalling the extension or importing the old seed offers no security benefit.
Users should monitor on-chain activity for their addresses and watch for further updates from the Polkadot Technical Fellowship. No network-level compromise occurred, but third-party wallet security practices across the ecosystem now face increased scrutiny.
- Generate new keypairs in a different wallet application.
- Transfer all assets, including staked positions, to the new accounts.
- Remove the Fearless Wallet extension from every browser.
- Ignore any unsolicited messages requesting seed phrases.
Frequently asked questions
Is Fearless Wallet safe to use after the disclosure?
The browser extension contained malicious code that exposed private keys. Users must treat any keys that passed through versions 3.0.1 through 3.0.5 as compromised and migrate funds to new accounts created in another wallet.
What should I do if I used the Fearless Wallet extension?
Create new keypairs in a maintained wallet such as Nova Wallet. Transfer all assets immediately across every chain. Removing the extension or changing passwords does not restore security to exposed keys.
Did the mobile apps contain the same vulnerability?
Reviewed Android and iOS versions did not include the malicious code. Keys previously imported or generated in the browser extension remain exposed even if later used on mobile.
How long did the private key exposure last?
The code was added on February 19, 2025, and remained active in installed extensions until at least October 10, 2026, despite removal from the source repository in June 2026.
TrustScope
Comments 2