A security breach involving the browser extension for Fearless Wallet may have exposed Polkadot users’ private keys for almost 20 months, creating a direct risk of unauthorized transfers. The incident has also drawn attention to Polkadot’s July decision to shorten the time needed to unstake DOT, which can reduce the period available to protect compromised funds.
According to CryptoSlate, the Polkadot Community Foundation said on Oct. 21 that malicious code had been present in the third-party Fearless Wallet browser extension since February 2025. The code was capable of extracting credentials from users’ wallets, including recovery phrases, private keys and keystore files.
The foundation advised anyone who had used the browser extension to create a new keypair with a different wallet and transfer any remaining assets immediately. Creating new credentials is important because reinstalling the extension, changing a password or importing the same recovery phrase into another wallet would not remove the underlying exposure.
Eight users have reported unauthorized transactions involving 17,286 DOT. The reported figure does not establish the total value potentially at risk, nor does it show that every user of the extension suffered a loss. It does, however, demonstrate how an exposed private key can enable transfers without the legitimate holder’s approval.
What investigators found in the extension
The Polkadot Technical Fellowship investigated the incident, while blockchain security firm SlowMist identified the affected extension versions as 3.0.1 and 3.0.3 through 3.0.5.
SlowMist said the malicious code could collect wallet information when users unlocked the extension and send it to an external server through HTTP requests. The information included recovery phrases, private keys and keystore files—credentials that can provide control over an account’s assets.
Investigators also found a remote configuration feature that could turn the malicious behavior on or off. Such a mechanism can make suspicious activity more difficult for users to detect because the code does not necessarily behave the same way at all times.
The offending code was removed from the source in June, and the remote switch was disabled in October. Those changes did not undo the exposure of credentials that may already have been collected. Users whose keys were revealed therefore remain at risk unless they move their assets to accounts created with entirely new credentials.
The foundation said its review of the mobile applications did not find the same malicious code. That does not protect users who imported compromised credentials into a mobile wallet or another application, because the private keys themselves may already be known to an attacker.
Why Polkadot’s staking change matters
The breach has highlighted a separate security consideration arising from Polkadot’s staking rules. Under Referendum 1910, implemented on July 6, the network reduced the maximum unbonding period for nominators from 28 days to two days and removed slashing penalties for nominators.
Unbonding is the process of releasing staked tokens before they can be transferred. Under the revised system, newly initiated nominator withdrawals can generally become available in about 24 to 48 hours, depending on the network’s staking schedule. The change was designed to let participants access their funds sooner and make staking more attractive.
The shorter period can also reduce the time available to respond when a wallet is compromised. Previously, an attacker who initiated an unstaking request could face a delay of up to four weeks before the tokens became transferable. That period could give the legitimate owner or a recovery specialist more time to detect the activity and try to protect the funds.
The risk was identified before the Fearless Wallet disclosure. On June 30, PAPI Rescue, a recovery service developed by the polkadot-api team, warned that moving from a 28-day period to two eras could leave too little time to intervene in compromised accounts unless users sought help quickly.
The shorter unbonding period has not been established as the cause of the unauthorized transfers reported by Fearless Wallet users. Account circumstances also differ: requests made before the upgrade kept their earlier schedules, while validators and some other locked balances are subject to different restrictions.
Recovery options depend on timing
The incident illustrates why a stolen private key does not automatically mean every asset can be recovered—or that a specialist can intervene indefinitely. Whoever controls the key generally has the same signing authority as the account’s legitimate owner. Recovery efforts therefore depend on whether Polkadot’s transaction and staking rules still keep funds locked and whether intervention remains technically possible.
PAPI Rescue says it has recovered more than $250,000 from compromised accounts and reports a 100% success rate among eligible cases it has handled. Those figures are the service’s own claims and do not guarantee that it can recover funds in every situation. Its process includes verifying ownership and examining the account’s transaction and staking conditions.
Polkadot’s foundation has directed affected holders with staked or otherwise constrained assets to consider PAPI Rescue before unstaking, because starting an exit can change when the funds become transferable. It has also warned users about unsolicited recovery offers and said private keys should never be disclosed, including to people claiming to provide recovery assistance.
For users of the affected browser extension, the immediate security step is to create a new keypair through a different wallet and move remaining funds. Holders with staked DOT must also consider the applicable withdrawal restrictions before taking action, since the opportunity to protect locked assets may narrow once they become transferable.
Current DOT market picture
Moneyiar market data at 22:38 on Oct. 25, 2026, showed Polkadot (DOT) at $1.0330667902. The token was down 0.39% over 24 hours and 5.65% over seven days. These market movements do not establish a direct connection with the Fearless Wallet breach.
