EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar25 Oct 2026
The Fearless Wallet browser extension leaked Polkadot users' private keys from February 2025, with eight users reporting 17,286 DOT in unauthorized transfers. Polkadot's July cut of the nominator unbonding period from 28 days to about two days means affected holders have far less time to react.
Altcoins TradeReviewed News Desk
A wallet extension that leaked keys for 20 months
The Polkadot Community Foundation warned on October 21 that the third-party Fearless Wallet browser extension had been leaking users’ private keys since February 2025, CryptoSlate reports. The disclosure followed an investigation by the Polkadot Technical Fellowship, which found malicious code able to extract wallet credentials.
According to the foundation, eight users have reported unauthorized transactions involving 17,286 DOT. Security firm SlowMist identified the affected extension versions as 3.0.1 and 3.0.3 through 3.0.5. The code could collect recovery phrases, private keys and keystore files when a wallet was unlocked and send them to an external server, and a remote configuration switch could turn the behavior on or off. Investigators said the code was removed from the source in June and the remote switch was disabled in October, but that does not undo exposure that already happened.
The foundation’s advice is direct: anyone who used the extension should create a new keypair in a different wallet and move funds as soon as possible. Investigators found that the reviewed mobile apps did not contain the same malicious code.
Why faster unstaking changes the picture
The incident lands three months after Referendum 1910 took effect on July 6. That upgrade removed slashing penalties for nominators and cut their maximum unbonding period from 28 days to about two days, making staked DOT far more liquid.
The trade-off is time. Under the old rules, an attacker who started unstaking from a compromised account could wait up to four weeks before the DOT became transferable, which gave the real owner or recovery specialists a window to react. Now newly initiated nominator withdrawals can become available in roughly 24 to 48 hours. PAPI Rescue, a recovery service built by the polkadot-api team, had flagged this risk on June 30, before the upgrade went live.
CryptoSlate stresses that the shorter unbonding period has not been shown to be the cause of any of the reported thefts. Unbonding requests opened before July kept their earlier schedules, and validators face different rules.
What it means for traders
If you ever used Fearless Wallet’s browser extension, treat the seed phrase as burned. Reinstalling the extension, changing the password or importing the same phrase into another wallet does not fix the problem. Holders with staked or locked DOT should check their withdrawal restrictions before acting, since starting an exit could shorten the time before an attacker can move the funds. The foundation also warns against unsolicited recovery offers and says never to share a private key with anyone, including recovery teams.
More broadly, the case shows that faster liquidity in staking protocols also shrinks the margin for error when keys leak. Keeping long-term holdings in a hardware wallet and only small trading balances in browser extensions or on exchanges limits the damage of a single compromised tool.
If you are choosing where to trade, see our crypto exchange comparison and how we test exchanges. Our current top picks are BingX and OKX.
Not financial advice.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.