Threat Pulse 62High
Polkadot warns Fearless Wallet extension leaked private keys for 20 months
Severity 5ActiveconfirmedCryptoConsumer devices

Malicious code merged into the Fearless Wallet browser extension on February 19, 2025 sent users' private keys to an attacker server whenever the wallet was unlocked, intermittently until at least October 10, 2026 (versions 3.0.1, 3.0.3, 3.0.4, 3.0.5). Eight users reported 17,286 DOT stolen. Every account used with the extension since February 2025 should be treated as compromised and funds moved to a new wallet.

What to do: Updating does not help; migrate to new keys (Polkadot suggests Nova Wallet); about 6,000 users still on an affected version.

· 15 days ago · about 6,000 Chrome Web Store users; 17,286 DOT confirmed stolen · Crypto Briefing
SourcesCrypto BriefingDeFiPrimeCryptopolitanforum.polkadot.networkhacked.slowmist.io
Why this score

Thousands of users (impact 1), live key theft and drains (exploitability 3), finance touched (criticality 1).

Back to the board

Updated Nov 5, 01:47 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.