A 20-month Polkadot wallet breach reveals the dark side of faster crypto withdrawals

The Polkadot Community Foundation warned on Oct. 21 that the third-party Fearless Wallet browser extension had been leaking users' private keys since February 2025, potentially exposing their assets to unauthorized transfers. The disclosure followed an investigation by the Polkadot Technical Fellowship, which identified malicious code capable of extracting wallet credentials.

The foundation urged affected users to generate new private keys using another wallet and move their remaining funds immediately. Eight users had reported unauthorized transactions involving 17,286 DOT, according to the foundation.

Security vulnerability identified

Blockchain security firm SlowMist identified affected extension versions as 3.0.1 and 3.0.3 through 3.0.5. According to the firm, malicious code could collect recovery phrases, private keys and keystore files when users unlocked their wallets, transmitting the information through HTTP requests to an external server.

A remote configuration mechanism also allowed the malicious behavior to be switched on or off, potentially making it harder for users to identify the compromise. Investigators said the offending code was removed from the source in June, while the remote switch was disabled in October.

Faster withdrawals create trade-off

The breach has raised questions about a July network upgrade that reduced the time needed to unstake DOT from as long as 28 days to approximately one or two days. While the change improved liquidity for token holders, it also shortened the window available to recover funds from compromised staking accounts before those assets become transferable.

Previously, an attacker initiating an unstaking request could face a waiting period of up to four weeks before the assets became transferable. Under the revised rules, newly initiated nominator withdrawals can become available in approximately 24 to 48 hours, depending on the network's staking schedule.

On June 30, PAPI Rescue, a recovery service developed by the polkadot-api team, warned that reducing the unbonding period from 28 days to two eras could leave insufficient time to intervene in compromised accounts unless users contacted recovery specialists promptly. The foundation has since directed affected holders with constrained assets to consider PAPI Rescue before unstaking.