🚨 DOT holders who have used the Fearless Wallet browser extension: switch wallets now
Polkadot has just issued a warning: a third-party browser extension for Fearless Wallet was injected with malicious code in February 2025 and secretly sent users’ private keys to attackers until October 10, 2026.
For nearly 20 months, almost nobody noticed.
🔹 Affected: Relevant extension versions on Chrome and Firefox
🔹 Known losses: 17,286 DOT stolen from 8 users
🔹 The mobile app is unaffected, but if you use the same seed phrase on your phone and in the extension, you’re also at risk
🔹 Official advice: Generate new keys in another wallet and transfer your funds immediately. Consider using a hardware wallet first.
🔹 Also, a warning: Anyone claiming they can help you “recover your funds” is most likely part of a second wave of scammers.
My take: The scariest thing about this incident isn’t the amount stolen—it’s how long it went on. The extension opened and signed transactions normally every day, making everything look fine, while your private keys had long since stopped being yours.
Extension wallets are convenient, but they live in your browser. Ordinary users simply can’t keep track of everything installed in their browser or every update to their extensions. Keeping large holdings in a hardware wallet and only leaving small amounts for everyday use in an extension is an old rule for a reason.
Also, “switching wallets” does not mean importing your old seed phrase into a new wallet. Generate a completely new seed phrase and then transfer your funds. Your old seed phrase has already been exposed, so importing it anywhere leaves you just as vulnerable.
What’s your primary wallet right now: a browser extension, a mobile app, or a hardware wallet? How often do you check the browser extensions you have installed?
#Polkadot #DOT #钱包安全 #PrivateKey
Polkadot has just issued a warning: a third-party browser extension for Fearless Wallet was injected with malicious code in February 2025 and secretly sent users’ private keys to attackers until October 10, 2026.
For nearly 20 months, almost nobody noticed.
🔹 Affected: Relevant extension versions on Chrome and Firefox
🔹 Known losses: 17,286 DOT stolen from 8 users
🔹 The mobile app is unaffected, but if you use the same seed phrase on your phone and in the extension, you’re also at risk
🔹 Official advice: Generate new keys in another wallet and transfer your funds immediately. Consider using a hardware wallet first.
🔹 Also, a warning: Anyone claiming they can help you “recover your funds” is most likely part of a second wave of scammers.
My take: The scariest thing about this incident isn’t the amount stolen—it’s how long it went on. The extension opened and signed transactions normally every day, making everything look fine, while your private keys had long since stopped being yours.
Extension wallets are convenient, but they live in your browser. Ordinary users simply can’t keep track of everything installed in their browser or every update to their extensions. Keeping large holdings in a hardware wallet and only leaving small amounts for everyday use in an extension is an old rule for a reason.
Also, “switching wallets” does not mean importing your old seed phrase into a new wallet. Generate a completely new seed phrase and then transfer your funds. Your old seed phrase has already been exposed, so importing it anywhere leaves you just as vulnerable.
What’s your primary wallet right now: a browser extension, a mobile app, or a hardware wallet? How often do you check the browser extensions you have installed?
#Polkadot #DOT #钱包安全 #PrivateKey