Polkadot reports a key leak at Fearless Wallet, 17,286 DOT are gone: how to check your extension

Here is what is documented: four versions of the Fearless Wallet browser extension sent a copy of the private key to a server belonging to an attacker whenever the wallet was unlocked. Eight users have reported unauthorised transfers so far, totalling 17,286 DOT. Our assessment follows further below: the number of reported cases is the smaller part of the problem.

The notice is dated October 21, 2026. The product affected is a third-party one, not the network's official software: Fearless Wallet was never an official Polkadot wallet. In concrete terms it still means this: if that extension sat on your machine at any point since February 2025, every account created with it counts as exposed, whether or not anything has drained from it so far.

What the Polkadot Community Foundation reported on October 21

The security notice describes neither an attack on the blockchain nor a flaw in the network itself. At its centre is a browser extension that did something other than what it claimed to its users. On unlocking the wallet, the extension sent the private key to an external address on the network. The key is the master key to an account: whoever holds it can sign any transfer without knowing the password and without needing access to the machine.

Among others, Cryptobriefing covered the notice the same day, and the report ran in parallel across several industry outlets. The foundation's recommendation fits in one sentence: anyone who used the affected extension since February 2025 should treat all accounts connected to it as compromised, generate fresh keys in a different wallet and send the balance there. The foundation names Nova Wallet as the destination.

These four versions of the extension are affected

The notice names four releases: 3.0.1, 3.0.3, 3.0.4 and 3.0.5. You will find the version number of a Chrome extension in the browser's extensions overview, reachable from the address bar with chrome://extensions and listed there under the wallet's entry. It does not appear inside the wallet itself. Anyone who has since deleted the extension will no longer find the number there. In that case the same rule applies as to everyone else in doubt: take February 2025 as the cut-off date and assume an exposed key.

When the warning went out, an affected release was still available for download in the Chrome Web Store. The listing showed around 6,000 users. That figure is not a count of victims but a count of installations, and precisely there lies the gap between eight reported cases and what is actually exposed.

How the malicious code entered the project in February 2025

The route in is unusually well documented. The code entered the project on February 19, 2025 through a pull request, that is, a proposed change submitted on GitHub of the kind any outsider can send to an open project. The proposal was tied to the orbit of the TON ecosystem. It was accepted like an ordinary extension of the feature set.

This design of attack does not hit the blockchain but the software supply chain ahead of it. It works because the malicious part only takes effect after the build and release, and because nothing looks different to the user. According to the foundation, the leak ran intermittently, and at least until October 10, 2026. More than 19 months therefore lie between the insertion and the last documented outflow.

A second point belongs here, uncomfortable as it is: complaints with the same pattern, money gone after an update, were already being described in the network's public forums in October 2025. The detailed technical explanation came a year later. That gap between the first signals and the full account is the part of the episode that counts beyond this single case.

Why an update or a reinstall rescues nothing

This is the point at which most of those affected take the wrong turn. A private key is not a set of login credentials that can be swapped out. It is the mathematical basis of the account itself. Whoever obtains it once keeps a working copy, even if the extension is deleted, reinstalled or updated to a clean version. A new password protects only the local vault on your own machine, not the account on the blockchain.

That leaves exactly one effective step: generate a new key pair in a different wallet and transfer the balance there. The old address stays unsafe for good, even if nothing happens for months. An attacker holding a copy of the key can wait until the grab is worth making, and that waiting is exactly why eight reported cases against roughly 6,000 installations are no all-clear.

The notice also refers explicitly to mobile devices. The malicious code was not found there. Anyone who once imported the same private key into the browser extension must nonetheless treat it as exposed, wherever else it sits. For long-term custody of larger holdings, a device that never passes the key to a browser in the first place remains the sensible choice. Which models cost what and which blockchains they support is set out in the hardware wallet comparison.

Staked and locked DOT: the unbonding period stands in the way

Moving out is simple as long as the balance is freely available. With Polkadot it often is not. Anyone who has staked their DOT cannot reach them at once: between unbonding and free availability lies the unbonding period. For nominators it has been at most two eras, roughly two days, since Referendum 1910 took effect on July 6, 2026; before that it was 28 days. What staking earns is covered in our calculation of the staking yield. (Corrected on November 9, 2026: this paragraph originally gave an unbonding period of 28 days.) During that time the balance sits at an address whose key may be in someone else's hands.

The foundation concedes that locked and staked holdings require additional steps, and for certain cases it points to tools such as PAPI Rescue. In practice that means moving the freely available holdings first, starting the unbonding from staking in parallel, and putting the day the period expires in the calendar. Postponing the unbonding only extends the window in which someone else's key stays usable. How other networks set their lock-up periods is shown in the staking provider comparison.

The DOT price sits at $1.16, and the report barely moves it

DOT traded at around $1.16 on Wednesday afternoon, down about 1.8 percent within 24 hours according to CoinGecko data. The daily high was $1.18 and the daily low $1.14. Market value stands just under $2 billion, which corresponds to rank 51.

On October 17, when we wrote about the cap of 2.1 billion DOT, the price stood at $1.18. Little has moved since then, and Wednesday's report has not changed that so far. There is an explanation: 17,286 DOT equal around $20,000 at today's price. Against a daily trading volume of some $139 million, that quantity goes unnoticed on the market.

The levels that count today are therefore the same as before the report. On the downside, the daily low at $1.14 is the first line, below it the monthly low of October 9 at just under $1.09. On the upside stands the daily high at $1.18, and only above that does the area around $1.24 come back into view, where the price last sat on October 11 and 12.

Holding period and tax: moving to your own new wallet is not a sale

Many hesitate over the move because they fear a taxable event. Under the German Federal Ministry of Finance's guidance on crypto assets, a transfer between two of your own wallets is not a disposal: the place of storage changes, not the owner. The one-year holding period pursuant to Section 23 of the German Income Tax Act therefore continues to run; it does not start afresh.

Documentation does matter, though. Record the date, the amount, the sending and receiving addresses and the transaction receipt, so that acquisition dates can be matched up later. Anyone who has received staking rewards keeps those items separate. What is currently moving politically on these deadlines we track continuously in the status of the holding period reform.

Recovery fraud: the second wave after every leak

In the same notice the foundation warns of a follow-on phenomenon that appears after every major incident: people posing as helpers who promise, against payment up front, to recover lost holdings. Technically that is ruled out. A confirmed transfer on a blockchain cannot be reversed, and nobody can undo one without holding the recipient's key.

Anyone who is approached should know the rule: legitimate bodies never demand an advance payment for a recovery and never ask for the recovery words. If the seed phrase is requested, the matter is settled. The incident belongs instead in a report to the local police, and the transaction receipts belong secured before the old wallet is deleted.

Our assessment: the number of reports is no measure

From the newsroom's point of view, the loss of 17,286 DOT is not the story. Three things are documented that together weigh more heavily: a span of more than 19 months between the insertion in February 2025 and the last documented outflow on October 10, 2026; roughly 6,000 installations in the Chrome Web Store when the warning appeared; and first public complaints with the same pattern as early as October 2025. Concluding from eight reports that this is the extent of it confuses reported with affected.

A serious qualification speaks against that: nobody knows how many of the 6,000 installations held any balance at all, and many extensions sit unused in the browser after being tried once. An extrapolation would therefore be unsound. Only the direction is reliable, and it reads: the number of exposed keys is higher than the number of emptied accounts, and it stays that way as long as those keys are not replaced.

For the network itself, nothing follows from this about the technology. The blockchain did what it is supposed to do and executed validly signed transfers. The problem sat in the software ahead of it, and it sat there for a year and a half. That is exactly why the question of how long an exposed extension stays up in a browser vendor's store is the more interesting issue than the price on this Wednesday.

The Fearless Wallet leak: old keys stay exposed for good

Three steps order the rest:

1. Check in your browser's extensions overview whether one of the versions 3.0.1, 3.0.3, 3.0.4 or 3.0.5 was installed. For permanent custody afterwards, the hardware wallet comparison lists the devices that never hand the key to a browser.
2. Generate a fresh key pair in a different wallet and transfer all freely available DOT there. Where holdings are staked, also start the unbonding and factor in roughly two days of unbonding for nominators; the staking provider comparison shows how other networks handle it.
3. Document every transfer with the date, the amount and both addresses, so that the holding period demonstrably continues. You can follow the current state of the law through the holding period report.

Further reports on the notice and on the timeline have been collected by PANews.

(As of October 21, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)