Polkadot Warns Fearless Wallet Users to Move Funds After Private-Key Leak
- Published
- Updated
- Since then
- 2 new reports
Polkadot told Fearless Wallet extension users to move funds after a private-key leak affected the browser extension. The new coverage adds that the warning covered anyone who used the extension since February 2025, when malicious code began sending private keys to an attacker’s server, and that the affected code ran until October 10, 2026. Chrome still showed an affected extension version tied to about 6,000 users when the alert went out.
Key claims & sources
What it means
Fearless Wallet is a non-custodial browser extension built for the Polkadot and Substrate ecosystem, the kind of lightweight signer that lets holders interact with parachains without a hardware device. Browser extension wallets have been a recurring attack surface across chains, from supply-chain compromises of JavaScript libraries to malicious Chrome listings masquerading as legitimate tools. Here the compromise was quieter: code inserted on February 19, 2025 sat inside the extension sending out private keys for roughly 20 months before detection.
Anyone who installed or used Fearless Wallet since February 2025 now has to assume every key the extension ever touched is burned, not just recently active ones. That means generating entirely new seed phrases, moving tokens to a fresh wallet, and revoking any dApp approvals tied to the old addresses. With roughly 6,000 users still on the affected Chrome version when the alert went out, developers and exchanges watching Polkadot flows may need to flag or blacklist the exposed addresses.
A wallet marketed as giving users sole control of their keys instead handed a copy to an attacker's server for close to two years, which cuts against the basic promise of self-custody. The episode reopens a familiar question for browser-based crypto tools: store listings and code audits are supposed to catch exactly this kind of silent exfiltration, and here they did not for a long stretch. Timely disclosure matters, but it cannot undo funds already moved before the warning. (per cryptobriefing.com)
The malicious code reportedly kept running at different intervals until October 10, 2026, which sets a rough outer bound on how long exposure lasted, though the foundation's advice is to treat the entire window since February 2025 as unsafe. What settles the scale of damage is whether Chrome removes or forces an update on the flagged extension version, and whether on-chain tracing turns up funds already drained from the roughly 6,000 exposed Chrome installs before users act on the warning.
Market reaction i
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Crypto Briefing
context
The Crypto Guardian
context
our clock