Polkadot Warns Fearless Wallet Users to Move Funds After Private-Key Leak

Fearless Wallet is a non-custodial browser extension built for the Polkadot and Substrate ecosystem, the kind of lightweight signer that lets holders interact with parachains without a hardware device. Browser extension wallets have been a recurring attack surface across chains, from supply-chain compromises of JavaScript libraries to malicious Chrome listings masquerading as legitimate tools. Here the compromise was quieter: code inserted on February 19, 2025 sat inside the extension sending out private keys for roughly 20 months before detection.

Anyone who installed or used Fearless Wallet since February 2025 now has to assume every key the extension ever touched is burned, not just recently active ones. That means generating entirely new seed phrases, moving tokens to a fresh wallet, and revoking any dApp approvals tied to the old addresses. With roughly 6,000 users still on the affected Chrome version when the alert went out, developers and exchanges watching Polkadot flows may need to flag or blacklist the exposed addresses.

A wallet marketed as giving users sole control of their keys instead handed a copy to an attacker's server for close to two years, which cuts against the basic promise of self-custody. The episode reopens a familiar question for browser-based crypto tools: store listings and code audits are supposed to catch exactly this kind of silent exfiltration, and here they did not for a long stretch. Timely disclosure matters, but it cannot undo funds already moved before the warning. (per cryptobriefing.com)

The malicious code reportedly kept running at different intervals until October 10, 2026, which sets a rough outer bound on how long exposure lasted, though the foundation's advice is to treat the entire window since February 2025 as unsafe. What settles the scale of damage is whether Chrome removes or forces an update on the flagged extension version, and whether on-chain tracing turns up funds already drained from the roughly 6,000 exposed Chrome installs before users act on the warning.