A security breach in Fearless Wallet, a third-party browser extension for Polkadot, has exposed users' private keys since February 2025, the Polkadot Community Foundation warned on October 21. The malicious code could extract wallet credentials and transmit them to external servers, potentially exposing user assets to unauthorized transfers.
Blockchain security firm SlowMist identified affected extension versions as 3.0.1 and 3.0.3 through 3.0.5. The malicious code included a remote configuration mechanism that allowed attackers to toggle the breach on or off, making detection more difficult. While the offending code was removed from the source in June and the remote switch was disabled in October, those changes cannot invalidate credentials already exposed to attackers.
Eight users reported unauthorized transactions involving 17,286 DOT. The foundation urged affected users to generate new private keys using a different wallet and move their remaining funds immediately.
Shorter Staking Period Narrows Recovery Window
The breach coincides with a significant network change implemented on July 6 under Referendum 1910. Polkadot reduced the maximum unbonding period for nominators from 28 days to approximately two days, while also eliminating slashing penalties for nominators. The change was designed to make staking more attractive by allowing faster access to funds.
However, the accelerated timeline creates a security trade-off. Previously, an attacker initiating an unstaking request could face a waiting period of up to four weeks before assets became transferable, potentially giving legitimate owners or recovery specialists time to identify suspicious activity and intervene. Under the revised rules, newly initiated nominator withdrawals can become available in approximately 24 to 48 hours.
A recovery service called PAPI Rescue, developed by the polkadot-api team, had warned on June 30 that the shortened unbonding period could leave insufficient time to intervene in compromised accounts unless users contacted recovery specialists promptly. The warning preceded both the July implementation and Polkadot's October security alert.
The foundation has not established the shorter unbonding period as a cause of the unauthorized Fearless Wallet transfers reported so far. The timing also depends on individual account conditions, as unbonding requests initiated before the July upgrade retained their earlier schedules.
Recovery Options Depend on Timing
Recovery specialists face a narrower window to protect stolen funds. PAPI Rescue says it has recovered more than $250,000 in assets from compromised accounts, though its recovery process depends on whether Polkadot's transaction and staking rules can still prevent funds from being transferred at the time of intervention.
The foundation has warned affected users against unsolicited recovery offers and instructed them never to disclose private keys to anyone, including recovery teams. For users with staked DOT, initiating an unstaking request could accelerate when an attacker gains the ability to transfer assets, potentially closing the recovery window before intervention becomes possible.
Polkadot's investigators found that reviewed mobile applications did not contain the same malicious code identified in the browser extension. However, users who imported exposed credentials into another application remain vulnerable, as those private keys could already be known to attackers.
