A wallet extension secretly sent out private keys starting in February 2025. It took nearly 20 months for anyone to catch on.
The affected product was the Fearless Wallet browser extension, a third-party wallet for the $DOT and Kusama ecosystems, maintained by an independent team. Its Chrome Web Store page lists 6,000 users.
A little after 10 p.m. last night, Polkadot issued a security warning. The technical team traced the issue to a code change made on February 19, 2025, under the guise of work on the “TON ecosystem,” which introduced malicious code. In versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5, whenever users entered their password to unlock their wallet, their private keys could be sent to the attacker’s server. The code only worked intermittently, and remained there until October 10 this year.
So far, eight victims have come forward. A total of 17,286 DOT was stolen—about $19,000 at the current price of roughly $1.11 per DOT. Not a huge sum. But the malicious code sat there undetected for a year and a half, and no one knows how many people unlocked their wallets during that time. The mobile app was checked and found not to contain the code. But if the same recovery phrase was also imported into the extension, it should still be considered compromised.
The official advice is straightforward: set up a new wallet with a newly generated key, then move all your assets to it. Changing your password or switching wallet software alone won’t help—the private key has already been exposed.
That’s the part that sends a chill down your spine. These people didn’t click a phishing link or carelessly sign a transaction. They simply opened the extension as usual and entered their password.
The affected product was the Fearless Wallet browser extension, a third-party wallet for the $DOT and Kusama ecosystems, maintained by an independent team. Its Chrome Web Store page lists 6,000 users.
A little after 10 p.m. last night, Polkadot issued a security warning. The technical team traced the issue to a code change made on February 19, 2025, under the guise of work on the “TON ecosystem,” which introduced malicious code. In versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5, whenever users entered their password to unlock their wallet, their private keys could be sent to the attacker’s server. The code only worked intermittently, and remained there until October 10 this year.
So far, eight victims have come forward. A total of 17,286 DOT was stolen—about $19,000 at the current price of roughly $1.11 per DOT. Not a huge sum. But the malicious code sat there undetected for a year and a half, and no one knows how many people unlocked their wallets during that time. The mobile app was checked and found not to contain the code. But if the same recovery phrase was also imported into the extension, it should still be considered compromised.
The official advice is straightforward: set up a new wallet with a newly generated key, then move all your assets to it. Changing your password or switching wallet software alone won’t help—the private key has already been exposed.
That’s the part that sends a chill down your spine. These people didn’t click a phishing link or carelessly sign a transaction. They simply opened the extension as usual and entered their password.