Fearless Wallet Leak Exposes Polkadot Users’ Keys

| cryptoadventure.com
Polkadot has warned users of the Fearless Wallet browser extension that their accounts may be compromised. Versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 reportedly sent recovery phrases or keystore files to an external server when wallets were unlocked. The malicious code was introduced in February 2025 and could remain active in installed copies, even after it was removed from public source code in June 2026. The issue was confirmed in the Chrome extension; reviewed Android and iOS apps did not contain the code, though mobile users who imported the same credentials into the extension may also be at risk. Eight users reported unauthorised transactions. The Polkadot Community Foundation cited 17,286 DOT in affected reports, while its published transaction records total 15,571.99 DOT; the discrepancy has not been explained. The Foundation urged users to create new keys with another wallet, such as Nova Wallet, and move their assets. Updating or reinstalling Fearless Wallet, or changing a password, will not secure keys that may already be exposed. Staked or locked assets may require additional recovery steps, and users should beware of recovery scams. Fearless Wallet is a third-party product, not an official Polkadot wallet. The incident may weigh on confidence in wallet security, but its direct effect on DOT may be limited compared with a protocol-wide breach.
Neutral
The incident is a security concern for affected Fearless Wallet users, but the reported losses are limited in scale relative to Polkadot’s wider market and do not indicate a breach of the Polkadot protocol itself. In the short term, reports of stolen DOT and concerns about wallet security could prompt some holders to sell or move assets, potentially adding modest downward pressure and volatility. The 17,286 DOT figure cited by the Foundation also differs from the 15,571.99 DOT total in its transaction records, leaving uncertainty that could affect sentiment until clarified. Over the longer term, the impact on DOT will depend on whether further losses emerge and how effectively users are warned and supported. Because the issue concerns a third-party wallet extension and users can migrate to fresh keys, lasting price pressure appears less likely unless the incident expands or damages confidence in the broader Polkadot ecosystem.