Fearless Wallet extension exposed private keys since February, Polkadot warns
Security & Exploits ·
A browser-extension wallet used by Polkadot holders has been leaking private keys for months, prompting an urgent call to move funds.
Polkadot has warned that the Fearless Wallet browser extension has been stealing users' private keys since February 2025, according to defiprime.com. The affected releases are versions 3.0.1 and 3.0.3 through 3.0.5, and anyone who installed or updated to those builds is being told to assume their keys are compromised.
The advisory instructs affected users to move funds to a new wallet immediately rather than wait for a patch or further confirmation. Because the extension reportedly captured private keys at the point of use, simply updating to a newer version would not retroactively secure assets already exposed under the vulnerable releases; funds need to be migrated to freshly generated keys on a different wallet.
The warning covers a roughly eight-month exposure window stretching from February 2025 through the affected point releases, raising the possibility that keys were harvested well before the issue was publicly flagged. It is not stated how the extension captured the keys, how many users or how much value may have been affected, or how the flaw was first detected.
This incident follows a separate wallet-related compromise in the Polkadot ecosystem, in which the Nova Wallet account was compromised and users were told to ignore any associated airdrop claims or links. Taken together, the two episodes point to a pattern of wallet-layer security problems surfacing across the network's user-facing tools, distinct from the protocol-level risks, such as bridge exploits, that have drawn separate scrutiny.
What remains unclear is the root cause of the Fearless Wallet key leakage, whether a fix has been shipped for the listed versions, and whether any funds have already been moved out of affected wallets as a result. Users on the named versions are advised to treat existing keys as burned and to complete migration before taking any further action with those wallets.