Polkadot third-party wallet plugin stole private keys for nearly 20 months! Unbonding cut from 28 days to 2, leaving almost no time to rescue stolen funds
📌 Polkadot forum security advisory (10/21): Third-party Fearless Wallet browser extension versions 3.0.1 and 3.0.3–3.0.5 contain malicious code that sends private keys to an attacker’s server when the wallet is unlocked. It intermittently activated from February 2025 through October 10, 2026; this is not an official wallet.
📌 8 users have reported unauthorized transfers totaling 17,286 DOT. SlowMist says the malicious code can collect seed phrases, private keys, and keystores, and can be remotely enabled or disabled.
📌 CryptoSlate (10/25): In July, Referendum 1910 cut nominators’ unbonding period from up to 28 days to around 1–2 days, greatly reducing the time left for account owners and rescuers after an attacker initiates unbonding.
【Analysis】
The issue this time isn’t with the blockchain itself, but with the “supply chain”: the malicious code was hidden in a major update labeled as part of the TON ecosystem, and open source didn’t prevent it. More importantly, shortening the unbonding period improves liquidity but also removes a safety buffer. This is a trade-off all PoS chains have to consider.
【Opportunities/Risks】
1. If you used this extension: The official recommendation is to assume all accounts have been compromised. Immediately use a different wallet to generate new private keys and transfer your funds. If your funds are staked and locked, contact a rescue team before unbonding.
2. DOT sentiment may come under pressure in the short term, but reported losses are currently limited. Watch whether the number of victims grows.
3. Demand may continue to rise for hardware wallets, multisig, and security solutions with delayed withdrawals.
4. Beware of direct-message scams claiming they can “recover your funds.” No one needs your private key.
Do you think the unbonding period should be shorter for liquidity, or longer for security?
#Polkadot #钱包安全 #私钥泄露 #加密安全 $DOT
For reference only; this is not investment advice.
📌 Polkadot forum security advisory (10/21): Third-party Fearless Wallet browser extension versions 3.0.1 and 3.0.3–3.0.5 contain malicious code that sends private keys to an attacker’s server when the wallet is unlocked. It intermittently activated from February 2025 through October 10, 2026; this is not an official wallet.
📌 8 users have reported unauthorized transfers totaling 17,286 DOT. SlowMist says the malicious code can collect seed phrases, private keys, and keystores, and can be remotely enabled or disabled.
📌 CryptoSlate (10/25): In July, Referendum 1910 cut nominators’ unbonding period from up to 28 days to around 1–2 days, greatly reducing the time left for account owners and rescuers after an attacker initiates unbonding.
【Analysis】
The issue this time isn’t with the blockchain itself, but with the “supply chain”: the malicious code was hidden in a major update labeled as part of the TON ecosystem, and open source didn’t prevent it. More importantly, shortening the unbonding period improves liquidity but also removes a safety buffer. This is a trade-off all PoS chains have to consider.
【Opportunities/Risks】
1. If you used this extension: The official recommendation is to assume all accounts have been compromised. Immediately use a different wallet to generate new private keys and transfer your funds. If your funds are staked and locked, contact a rescue team before unbonding.
2. DOT sentiment may come under pressure in the short term, but reported losses are currently limited. Watch whether the number of victims grows.
3. Demand may continue to rise for hardware wallets, multisig, and security solutions with delayed withdrawals.
4. Beware of direct-message scams claiming they can “recover your funds.” No one needs your private key.
Do you think the unbonding period should be shorter for liquidity, or longer for security?
#Polkadot #钱包安全 #私钥泄露 #加密安全 $DOT
For reference only; this is not investment advice.
