If you’ve used the Fearless extension, check your old recovery phrase even after switching wallets
Importing an old recovery phrase into another wallet does not create a new account. If you’ve used the Fearless browser extension, the most important thing to check now is the key’s usage history—not just which app you currently have open.
At 10:00 p.m. Beijing time on October 22, I read-only reviewed the October 21 security notice published on the official forum by the Polkadot Community Foundation. The notice lists code in extension versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 that could expose private keys by sending them out when the extension was unlocked. The Chrome version has been confirmed affected; the Firefox extension uses the same code and should also be treated as compromised. This is a third-party wallet, not an official Polkadot wallet. I am citing the investigation notice, not claiming to have independently reproduced the vulnerability.
Here are four things to check:
① Check your usage history. If you’ve used the extension since February 2025, assess the accounts you used with it according to the notice. Checking only whether you’ve updated, reinstalled, or changed your password today cannot rule out a past exposure.
② Check for key reuse. The notice says that the Android and iOS versions reviewed did not contain this code. But if the same key was ever used in the extension, switching it to a phone or another wallet later does not automatically make it safe again. Switching apps and creating a new key are two different things.
③ Check the status of your funds. The steps for available balances differ from those for staked funds, nomination pools, and governance-locked funds. Don’t assume that “changing keys” means all funds can be transferred out immediately. I have not tested any recovery tools in this review, and I cannot guarantee recovery or a fixed waiting period.
④ Check where you seek help. Polkadot has no customer support account on X, according to the official warning. Ignore unsolicited direct messages from “recovery agents,” and never share your recovery phrase or private key. Look up any follow-up information in the original notice.
Related market data is only background: Binance DOT/USDT rose about 0.60% during the complete hour from 01:00 to 02:00, with trading volume of about 253,100 USDT—0.49 times the average of the previous five complete hours. Neither a price increase nor lower trading volume can verify whether an account’s key is safe, or be used to infer that the exposure has ended.
My view is that account control depends on the key; changes to an app’s interface are no substitute for checking whether the key was exposed. If the official assessment of affected versions is revised, check again against the new notice. This provides a read-only assessment process; I will not connect to wallets, sign transactions, or transfer funds on readers’ behalf. $DOT
Importing an old recovery phrase into another wallet does not create a new account. If you’ve used the Fearless browser extension, the most important thing to check now is the key’s usage history—not just which app you currently have open.
At 10:00 p.m. Beijing time on October 22, I read-only reviewed the October 21 security notice published on the official forum by the Polkadot Community Foundation. The notice lists code in extension versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 that could expose private keys by sending them out when the extension was unlocked. The Chrome version has been confirmed affected; the Firefox extension uses the same code and should also be treated as compromised. This is a third-party wallet, not an official Polkadot wallet. I am citing the investigation notice, not claiming to have independently reproduced the vulnerability.
Here are four things to check:
① Check your usage history. If you’ve used the extension since February 2025, assess the accounts you used with it according to the notice. Checking only whether you’ve updated, reinstalled, or changed your password today cannot rule out a past exposure.
② Check for key reuse. The notice says that the Android and iOS versions reviewed did not contain this code. But if the same key was ever used in the extension, switching it to a phone or another wallet later does not automatically make it safe again. Switching apps and creating a new key are two different things.
③ Check the status of your funds. The steps for available balances differ from those for staked funds, nomination pools, and governance-locked funds. Don’t assume that “changing keys” means all funds can be transferred out immediately. I have not tested any recovery tools in this review, and I cannot guarantee recovery or a fixed waiting period.
④ Check where you seek help. Polkadot has no customer support account on X, according to the official warning. Ignore unsolicited direct messages from “recovery agents,” and never share your recovery phrase or private key. Look up any follow-up information in the original notice.
Related market data is only background: Binance DOT/USDT rose about 0.60% during the complete hour from 01:00 to 02:00, with trading volume of about 253,100 USDT—0.49 times the average of the previous five complete hours. Neither a price increase nor lower trading volume can verify whether an account’s key is safe, or be used to infer that the exposure has ended.
My view is that account control depends on the key; changes to an app’s interface are no substitute for checking whether the key was exposed. If the official assessment of affected versions is revised, check again against the new notice. This provides a read-only assessment process; I will not connect to wallets, sign transactions, or transfer funds on readers’ behalf. $DOT