Polkadot warns Fearless extension users to replace exposed keys

The Polkadot Community Foundation issued a security alert on October 21, 2026, warning that the Fearless Wallet browser extension had leaked users' private keys since February 2025. The Foundation’s notice instructs anyone who used the extension during that period to generate a new private key outside of Fearless and move their funds to the new account.

The warning follows an investigation by the Polkadot Technical Fellowship on behalf of the Foundation. The Foundation emphasizes that Fearless is independently built and maintained and has never been an official Polkadot wallet.

The notice identifies browser extension versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 as containing the offending code. Investigators traced the introduction of the code into the public source to February 19, 2025.

Exposed accounts and affected platforms

The warning covers every account held in the browser extension, including accounts whose keys were later imported into another application. Moving to a different wallet interface protects the funds only if the user also creates a new keypair and transfers assets to it.

Investigators confirmed the code in Chrome packages. Firefox used the same source, but its extension was no longer listed, and investigators could not recover the published packages. The Foundation tells people who used the Firefox extension during the affected period to consider their keys compromised too.

The linked technical report distinguishes what investigators verified in published packages from what they found in the source. They recovered signed Chrome Web Store packages for versions 3.0.3, 3.0.4, and 3.0.5 and found the same code in each. They could not recover the published packages for versions 3.0.1 and 3.0.2.

The reviewed Android and iOS applications did not contain matching code. Their users can still be exposed through a shared key. The notice specifically identifies restoring a Fearless Google Drive backup into the browser extension as a way a mobile account’s phrase could have become compromised.

How the extension exported secrets

The technical report follows a function named fetchJettonInfo. Its name suggests token information, but the function takes part in collecting and sending account secrets. The wallet calls it after a password-entry attempt, including an unsuccessful one. An incorrect password prevents the export paths from decrypting the account material, so no key is collected or sent.

In versions 3.0.3 through 3.0.5, the function first requests a configuration file from the eth-enabled branch of the public soramitsu/shared-features-utils repository. A field named ton is both the switch that enables the function and the destination server address. If that field is absent, the function stops.

The code can collect a recovery phrase or an account’s keystore file together with the wallet password. This material gives control of the account; a public address, normally used to fetch a balance, does not. The report says the collection covers the wallet’s main accounts. The code skips accounts that return no material.

Before transmission, the code applies AES encryption with an empty passphrase. Anyone holding the transmitted text can reverse that operation using the same empty passphrase, the report explains. The encryption provides no protection against the receiving server or someone who can see the request.

The function joins the encrypted values into the address parameter of a GET request to the server’s whitelist endpoint. Because the payload is in the request address, the secrets can also appear in the server’s access logs. If the function encounters an error, it stops silently. The user sees no warning.

Next steps for affected users

The Foundation recommends creating a fresh keypair in a different, well-maintained wallet and checking every chain the old account uses. Where possible, it advises using another application to operate the old account instead of entering the password in Fearless again. Funds controlled by the same exposed key elsewhere also need to move.

Staked balances, nomination-pool positions, and assets locked by a governance vote may not be immediately transferable. Before beginning to unstake, the notice directs affected users to consider PAPI Rescue, a service built by the polkadot-api team for compromised accounts. It explicitly says never to share private keys with anyone, including that team.

The notice lists warning signs for users to check: staking stopped without permission, unbonding initiated unexpectedly, a changed staking reward destination, departure from a nomination pool, a removed governance vote, or small unexplained transfers. The list describes what affected users should look for, not what investigators found in every account that used the extension.

Once funds are safe, the Foundation advises removing the extension. Users who have lost assets should preserve account addresses, transaction hashes, dates, and amounts as evidence. The notice also warns against unsolicited recovery offers. Legitimate assistance does not require handing over a private key, and purported recovery agents may be another scam.

The technical report describes what the code did without determining who wrote it or why. Investigators did not contact the receiving server and do not have its records. What happened to the collected secrets remains unresolved.