The private keys were stolen for 20 months. No one noticed until 8 wallets had been emptied.
⚡ 有大动静群里说
A browser extension called Fearless Wallet has been sending users’ seed phrases and private keys out of their wallets since February 2025—and kept doing so through this October. The Polkadot community foundation didn’t issue a security warning until October 21. So far, 8 users have filed reports, with a total of 17,286 DOT transferred out, worth about $17,700 at current prices. 💥
The method wasn’t exactly new, but it was well hidden. The moment a user unlocked their wallet, malicious code in the extension bundled up their seed phrase, private key, and keystore file, then sent them to an external server via HTTP requests. Even worse, it had a remote toggle, allowing the attacker to turn it on or off at any time. Ordinary users had no way of knowing they were being harvested. 🦖
Security firm SlowMist later identified the affected versions as 3.0.1 and 3.0.3 through 3.0.5. The malicious code had already been removed from the source code in June, but the remote toggle wasn’t switched off until October. By then, what had been taken was gone for good. ⚠️
What made this incident more serious was Referendum 1910, which took effect on July 6. Polkadot cut the unbonding period for nominators from up to 28 days to around 2 days. In some cases, staked funds can be withdrawn in just 24 to 48 hours. The staking experience improved, but if someone else gets hold of your private key, the window victims have to notice something’s wrong, find help, and stop their assets from becoming transferable has shrunk from 4 weeks to just 2 days. 📉
To be clear, officials have explicitly said there’s currently no evidence that the shorter unbonding period caused these thefts. Some accounts submitted unbonding requests before the July upgrade and were still subject to the old rules. But the direction of the risk is already clear. On June 30, PAPI Rescue had warned that shrinking 28 days to two eras could leave too little time to intervene. The recovery service says it has already recovered more than $250,000.
My take: this isn’t just a Polkadot problem. It’s a trade-off every blockchain with faster withdrawals and smoother unlocking needs to consider. Liquidity is a product advantage; the recovery window is part of the security budget. Improving one often means reducing the other—and users tend to notice only the former.
There’s another mistake many people make: changing their password, reinstalling the extension, or importing the same seed phrase into a new wallet. None of that fixes the exposure. If your private key has ever been sent out, the only solution is to create a new key pair and move your assets. Officials also warn users not to trust recovery teams that contact them out of the blue—and never to give their private keys to anyone.
How many browser extensions do you still have installed on your phone or computer that you don’t really know much about? Tell us in the comments.
Tap the profile picture to watch the livestream.
Every day, we bring you the latest in crypto security—not just what’s happening, but the reasoning and opportunities behind it. 👀🚀
⚡ 有大动静群里说
A browser extension called Fearless Wallet has been sending users’ seed phrases and private keys out of their wallets since February 2025—and kept doing so through this October. The Polkadot community foundation didn’t issue a security warning until October 21. So far, 8 users have filed reports, with a total of 17,286 DOT transferred out, worth about $17,700 at current prices. 💥
The method wasn’t exactly new, but it was well hidden. The moment a user unlocked their wallet, malicious code in the extension bundled up their seed phrase, private key, and keystore file, then sent them to an external server via HTTP requests. Even worse, it had a remote toggle, allowing the attacker to turn it on or off at any time. Ordinary users had no way of knowing they were being harvested. 🦖
Security firm SlowMist later identified the affected versions as 3.0.1 and 3.0.3 through 3.0.5. The malicious code had already been removed from the source code in June, but the remote toggle wasn’t switched off until October. By then, what had been taken was gone for good. ⚠️
What made this incident more serious was Referendum 1910, which took effect on July 6. Polkadot cut the unbonding period for nominators from up to 28 days to around 2 days. In some cases, staked funds can be withdrawn in just 24 to 48 hours. The staking experience improved, but if someone else gets hold of your private key, the window victims have to notice something’s wrong, find help, and stop their assets from becoming transferable has shrunk from 4 weeks to just 2 days. 📉
To be clear, officials have explicitly said there’s currently no evidence that the shorter unbonding period caused these thefts. Some accounts submitted unbonding requests before the July upgrade and were still subject to the old rules. But the direction of the risk is already clear. On June 30, PAPI Rescue had warned that shrinking 28 days to two eras could leave too little time to intervene. The recovery service says it has already recovered more than $250,000.
My take: this isn’t just a Polkadot problem. It’s a trade-off every blockchain with faster withdrawals and smoother unlocking needs to consider. Liquidity is a product advantage; the recovery window is part of the security budget. Improving one often means reducing the other—and users tend to notice only the former.
There’s another mistake many people make: changing their password, reinstalling the extension, or importing the same seed phrase into a new wallet. None of that fixes the exposure. If your private key has ever been sent out, the only solution is to create a new key pair and move your assets. Officials also warn users not to trust recovery teams that contact them out of the blue—and never to give their private keys to anyone.
How many browser extensions do you still have installed on your phone or computer that you don’t really know much about? Tell us in the comments.
Tap the profile picture to watch the livestream.
Every day, we bring you the latest in crypto security—not just what’s happening, but the reasoning and opportunities behind it. 👀🚀