Polkadot warns users after browser extension breach exposed credentials
The Polkadot Community Foundation disclosed on October 21 that Fearless Wallet’s browser extension leaked users’ private keys for nearly 20 months, beginning in February 2025. The breach exposed DOT holders to potential theft and forced the foundation to issue an immediate security advisory.
“If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible,” Polkadot stated in its warning.
The Polkadot Technical Fellowship identified malicious code capable of extracting wallet credentials from affected versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the extension. Blockchain security firm SlowMist found that the code could collect recovery phrases, private keys, and keystore files when users unlocked their wallets, then transmit the data via HTTP requests to external servers. A remote configuration mechanism allowed the malicious behavior to be toggled on or off without requiring an update.
Eight Fearless Wallet users reported unauthorized transactions totaling 17,286 DOT following the breach. Malicious code was removed from Fearless Wallet’s source in June 2025, and a remote switch was disabled in October 2025.
Staking changes created narrower recovery window
The breach intersected with a significant change to Polkadot’s staking infrastructure. Referendum 1910, which took effect on July 6, 2025, reduced the maximum unbonding period for DOT from 28 days to 2 days. The change eliminated slashing penalties for nominators and was intended to make staking more attractive.
The timing created a critical vulnerability. Under the previous 28-day unbonding window, attackers faced up to four weeks before stolen assets became transferable. Under the revised rules, nominator withdrawals can become available within 24 to 48 hours.
On June 30, 2025, PAPI Rescue, a recovery service developed by the polkadot-api team, warned that reducing the unbonding period from 28 days to two eras could leave insufficient time to intervene in compromised accounts. The shorter window narrowed the recovery window for users and security teams attempting to prevent theft.
PAPI Rescue has recovered $250,000 in assets from compromised accounts and reported a 100% success rate among eligible cases, according to available data.
Mobile applications unaffected; imported credentials remain at risk
Polkadot mobile applications did not contain the same malicious code as the browser extension. However, users who imported credentials exposed by the Fearless Wallet breach into another application remain vulnerable to theft, as the underlying private keys are compromised regardless of where they are used.
The breach was first reported by CryptoSlate Senior Reporter Oluwapelumi Adejumo on October 21, 2025, based on the Polkadot Community Foundation’s disclosure.
