Key Takeaways
- • Polkadot warned users of the third-party Fearless Wallet browser extension to move their funds immediately after a security flaw leaked private keys to an attacker-controlled server.
- • Four versions of the extension transmitted users' private keys intermittently between February 2025 and October 2026, exposing accounts to theft.
- • At least eight users reported unauthorized transactions totaling 17,286 DOT.
- • Polkadot stressed that Fearless Wallet is not an official product and advised users to generate new keys in a different wallet, such as Nova Wallet.
- • Users were also cautioned about recovery scams and may need tools such as PAPI Rescue to access staked or locked funds.
Summary
Polkadot has alerted users of the third-party Fearless Wallet browser extension to move their funds immediately after discovering a security flaw that caused the extension to leak private keys to an attacker-controlled server. According to the primary report, the leak occurred intermittently from February 2025 to October 2026, and four versions of the extension sent users' private keys, exposing affected accounts to theft.
At least eight users have reported unauthorized transactions totaling 17,286 DOT. Polkadot emphasized that Fearless Wallet is not an official product and advised affected holders to generate new keys in a different wallet, such as Nova Wallet, and transfer their assets promptly. Users were also warned about potential recovery scams, and holders of staked or locked funds may need additional tools, such as PAPI Rescue, to move those assets.
The incident is a reminder of the counterparty and key-management risks associated with third-party browser extension wallets, particularly for institutional or family-office holders with exposure to Polkadot-based assets. The primary report did not specify the extension's developer or whether remediation has been completed.
Separately, the same Pluang market update noted that as of October 21, 2026, 21:43 WIB, 30 of 50 major cryptocurrencies rose while 19 fell. EOS was priced at Rp12.649 with an 8.13% increase, COMP at Rp455.340 with a 5.17% rise and 68% buy-order activity, and MANA at Rp1.597 with a 4.17% gain but 87% sell orders.
At least eight users have reported unauthorized transactions totaling 17,286 DOT. Polkadot emphasized that Fearless Wallet is not an official product and advised affected holders to generate new keys in a different wallet, such as Nova Wallet, and transfer their assets promptly. Users were also warned about potential recovery scams, and holders of staked or locked funds may need additional tools, such as PAPI Rescue, to move those assets.
The incident is a reminder of the counterparty and key-management risks associated with third-party browser extension wallets, particularly for institutional or family-office holders with exposure to Polkadot-based assets. The primary report did not specify the extension's developer or whether remediation has been completed.
Separately, the same Pluang market update noted that as of October 21, 2026, 21:43 WIB, 30 of 50 major cryptocurrencies rose while 19 fell. EOS was priced at Rp12.649 with an 8.13% increase, COMP at Rp455.340 with a 5.17% rise and 68% buy-order activity, and MANA at Rp1.597 with a 4.17% gain but 87% sell orders.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.