Polkadot has issued an urgent security alert after the Polkadot Technical Fellowship confirmed that the third-party Fearless Wallet browser extension has been leaking users’ private keys since February 2025. The warning tells users to create a new keypair and transfer their funds immediately.
Security firm SlowMist later identified malicious code in Fearless Wallet versions 3.0.1 and 3.0.3 to 3.0.5, meaning the exposure has lasted for nearly 20 months. The malicious code was designed to steal wallet recovery phrases, private keys, and keystore files. According to the alert, changing passwords or reinstalling the extension will not be enough to secure affected wallets; users must create new wallets and move assets.
Polkadot’s market price has shown no significant movement so far, but the incident may still weigh on user confidence and security sentiment across the ecosystem. The alert underscores the risks of browser-based wallet extensions and highlights the Polkadot community’s proactive response to third-party application vulnerabilities.
