DemoCrypto

Crypto, explained simply, without the jargon

Fearless Wallet: are your DOT at risk?

Daniel Platteau

In short: on 21 October 2026, the Polkadot Community Foundation warned that four versions of the Fearless Wallet browser extension (3.0.1, 3.0.3, 3.0.4 and 3.0.5) sent their users' private keys to an attacker's server, intermittently since February 2025. Eight users have reported unauthorised transfers totalling 17,286 DOT. Polkadot itself was not hacked: a third-party wallet was. If you used this extension, even once, since February 2025, treat every account it held as compromised: create new keys in another wallet and move your funds. Changing the password or reinstalling the extension does nothing.

Updated on 30 October 2026. This article is not financial advice.

What happened?

Fearless Wallet is a wallet for Polkadot and other networks, built by an independent team (the code is published under the GitHub account of Soramitsu, the team behind the SORA project). It exists as a mobile app and as a browser extension for Chrome and Firefox. The foundation stressed in its notice that it is not, and never was, an official Polkadot wallet (Moses, 2026).

On 21 October 2026, after an investigation by the Polkadot Technical Fellowship, the Polkadot Community Foundation published a security notice on the Polkadot forum. Four versions of the extension contained code that, when the user unlocked the wallet with the correct password, sent a copy of their keys to an outside server (Moses, 2026; CryptoTicker, 2026).

A technical analysis of the code, linked from the foundation's notice, describes how it worked (Fearless Wallet extension code analysis, 2026):

  • Version 3.0.1 (26 February 2025): the server address is hard-coded; the code runs when an account is created or imported, and at every unlock.
  • Versions 3.0.3 to 3.0.5 (March to April 2025): a configuration file hosted in a public repository acts as a remote switch. It was turned on during nine periods, about 571 days in total; the last one ran without a break from 15 May 2025 to 10 October 2026. The foundation warns that the leak "could be enabled again at any point in time" (Polkadot Community Foundation, 2026).
  • What was sent: the recovery phrase (12 or 24 words) when the account has one, otherwise the encrypted backup file and the password in plain text. In other words, enough to rebuild the key in every case.

The iOS and Android apps that were examined did not contain this code. But a key that was ever in the extension, for example restored from a Google Drive backup, is compromised wherever it is used (Polkadot Community Foundation, 2026).

The Polkadot blockchain was not hacked. The network worked normally: it executed transfers signed with valid keys. The problem lies in third-party software that leaked those keys.

How many victims?

The foundation lists eight cases reported publicly and traced on the blockchain, for 17,286 DOT in total (Moses, 2026). The public case log dates the first one to September 2025 and counts four in September 2026, one of them close to 9,000 DOT (Log of reported transactions, 2026). At about 1.16 dollars per DOT on the day of the alert, that is roughly 20,000 dollars (CryptoTicker, 2026).

That figure is a floor. Version 3.0.5 was still on the Chrome Web Store on 21 October, with some 6,000 users (Moses, 2026). Not all those installations held funds, but every copied key remains usable by the attacker until its owner moves the assets. Accounts not yet emptied are the real risk.

Are you affected?

Your situation Risk What to do
You used the Fearless Wallet extension since February 2025, on Chrome or Firefox High New keys and a transfer, right away
You imported into the extension a phrase you also use elsewhere (Nova, Talisman, SubWallet, Ledger…) High for every account derived from that phrase Same: the phrase is compromised, not the app
You only used the Fearless mobile app, with a phrase never imported into the extension Low according to the investigation Stay alert; migrate as a precaution if in doubt
You never used Fearless Wallet Not affected Still read the section on extensions

To check your version: type chrome://extensions in Chrome's address bar (or about:addons in Firefox) and look for Fearless Wallet; the version number is shown there, not in the wallet itself (CryptoTicker, 2026). If you already removed the extension without noting the version, assume you are affected.

What to do, in order

  1. Create a new wallet with a new recovery phrase, in other well-maintained software (the foundation names Nova Wallet) or, better for large amounts, a hardware wallet. Write the new phrase down on paper, offline.
  2. Make a small test transfer, then move your available DOT to the new address. Copy the address from your new wallet, never from a message or a transaction history.
  3. Don't forget other tokens: USDT, USDC or DED on Polkadot Hub, and any Ethereum or TON accounts managed by the same extension.
  4. Start unbonding your staked DOT immediately. Since referendum 1910 (July 2026), unbonding for nominators takes about 2 days instead of 28 (see our article on DOT staking). Good news for you… and for the attacker, who has less time to wait if he starts unbonding before you. If funds are locked or unbonding, the foundation points to PAPI Rescue, a tool from the polkadot-api team, to be consulted before you act (CryptoSlate, 2026).
  5. Keep a record of each transfer (date, amount, addresses) and, if you were robbed, file a police report with that evidence.
  6. Remove the extension, but only once your funds are safe: the malicious code remains in installed copies of versions 3.0.3 to 3.0.5. Removing it does not make the key safe again, though.

Beware of « recovery » services. After a theft, strangers offer to get your DOT back for an upfront fee. A confirmed transfer on the blockchain cannot be reversed, and no serious service will ask for your recovery phrase.

A transfer between your own wallets is not a sale: it does not trigger the new Belgian capital gains tax. Keep the evidence anyway; it will help you prove the origin and value of your assets.

Why browser extensions are the weak link

Fearless is not an isolated case. In late 2024, a widely used proxy extension was modified after its publisher's account was hacked, and given code able to steal keys; in 2026, fake TronLink extensions were circulating on the Chrome Web Store (Crowdfund Insider, 2025; SlowMist, 2026). A wallet extension combines three weaknesses:

  • It lives in the browser, the most exposed software on your computer, next to other extensions and every site you visit.
  • It updates itself. A booby-trapped version reaches thousands of users without anyone clicking anything.
  • It decrypts the key at every unlock. That is exactly the moment the Fearless code exploited.

A hardware wallet (Ledger, for example, or Polkadot Vault on an old offline phone) changes the picture: the key never leaves the device, and an extension such as Talisman becomes a mere interface. That is what we recommend for large amounts in our guide to the Polkadot wallet, along with the basic precautions in our article on security after a data leak.

Who is responsible?

That is the awkward question. As early as autumn 2025, a robbed user complained on the Polkadot forum that the Fearless team did not respond, about a wallet he described as officially recommended (Polkadot Forum, 2025). It took another year for the cause to be identified. To our knowledge, the Fearless team had published no explanation by 30 October 2026, and the technical analysis says neither who added the code nor why.

On the European side, since 11 September 2026 the Cyber Resilience Act has required manufacturers of digital products sold in the Union to report actively exploited vulnerabilities (European Commission, 2026). Does a free wallet developed outside the Union fall within that framework? That is far from obvious, and in any case the regulation provides for reporting and fines, not compensation for victims. In self-custody, nobody reimburses you.

True or false?

"Polkadot was hacked." False. The blockchain was not attacked; a third-party wallet leaked its users' keys.

"Updating the extension or changing the password is enough." False. A key that has already been copied remains valid. Only new keys, with a new phrase, protect you.

"Importing my phrase into Nova or Talisman solves the problem." False. The attacker has the same phrase: switching apps changes nothing.

"It takes 28 days to recover staked DOT." Not since July 2026: about 2 days for nominators. Articles that still quote 28 days are out of date.

"My DOT haven't moved, so I'm safe." False. A copied key can be used months later: one of the listed cases involved a user who had not used Fearless for more than a year and a half.

Test yourself

What should someone who has used the Fearless Wallet extension since February 2025 do to protect their DOT?

Show the answer

Answer: Create new keys in another wallet and move the funds there

The private key may have been copied: only a new recovery phrase, in another wallet, puts the funds out of the attacker's reach.

In the Fearless Wallet case of October 2026, what was hacked?

Show the answer

Answer: A third-party wallet's browser extension

The Polkadot network worked normally; four versions of the Fearless Wallet extension sent their users' keys to an attacker's server.

Since July 2026, how long does unbonding take for DOT staked by a nominator?

Show the answer

Answer: About 2 days

Referendum 1910 reduced nominator unbonding to about 2 eras, roughly 2 days.

Disclaimer

This article is for information only and is neither investment advice nor legal advice. The information on the incident comes from the Polkadot Community Foundation's notice and analyses published by 30 October 2026; it may change. Crypto-assets carry significant risks, including total loss.

Sources

Crowdfund Insider. (2025, March). Private keys may be exposed via critical vulnerability in SwitchyOmega, a Chrome proxy-switching extension. https://www.crowdfundinsider.com/2025/03/237454-private-keys-may-be-exposed-via-critical-vulnerability-in-switchomega-a-chrome-proxy-switching-extension-report/

CryptoSlate. (2026, October). A 20-month Polkadot wallet breach reveals the dark side of faster crypto withdrawals. https://cryptoslate.com/a-20-month-polkadot-wallet-breach-reveals-the-dark-side-of-faster-crypto-withdrawals/

CryptoTicker. (2026, 21 October). Polkadot reports a key leak at Fearless Wallet, 17,286 DOT are gone: how to check your extension. https://cryptoticker.io/en/polkadot-fearless-wallet-private-key-leak/

European Commission. (2026, 11 September). Safer and more secure digital products. https://commission.europa.eu/news-and-media/news/safer-and-more-secure-digital-products-2026-09-11_en

Fearless Wallet extension code analysis. (2026). How the offending code in the Fearless Wallet browser extension behaves. HackMD. https://hackmd.io/@gWEUMERvQZyR5MStsH26g/HyNOm782zg

Log of reported transactions. (2026, 21 October). Reported unauthorized transactions from Fearless Wallet users. HackMD. https://hackmd.io/@gWEUMERvQZyR5MStsH26g/r1lJdy8nGg

Moses, R. (2026, 21 October). Fearless Wallet extension leaked Polkadot users' private keys for 20 months. Cryptopolitan. https://www.cryptopolitan.com/fearless-wallet-leaked-polkadot-private-keys/

Polkadot Community Foundation. (2026, 21 October). Security notice: Fearless Wallet browser extension leaked private keys. Polkadot Forum. https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058

Polkadot Forum. (2025). Why is Polkadot officially recommending Fearless Wallet despite zero support, zero response to theft and confirmed app vulnerability? https://forum.polkadot.network/t/why-is-polkadot-officially-recommending-fearless-wallet-despite-zero-support-zero-response-to-theft-and-confirmed-app-vulnerability/15248

SlowMist. (2026, May). Report on a fake TronLink Chrome extension. Reported by VPN Central. https://vpncentral.com/?p=250079

Related articles

← Back to articles