- Polkadot warned that Fearless Wallet’s browser extension leaked users’ private keys for nearly 20 months, exposing DOT holders to potential theft.
- A July upgrade cut DOT unstaking delays from 28 days to as little as one day, reducing the time available to recover funds from compromised wallets.
- Recovery specialists warned about the shrinking intervention window months before the breach disclosure, raising questions about protecting locked assets.
Polkadot’s Fearless Wallet security breach has exposed a potential weakness in the network’s recently shortened staking withdrawal period.
The Polkadot Community Foundation warned on Oct. 21 that the third-party Fearless Wallet browser extension had been leaking users’ private keys since February 2025, potentially exposing their assets to unauthorized transfers.
The disclosure followed an investigation by the Polkadot Technical Fellowship, which identified malicious code capable of extracting wallet credentials. The foundation urged affected users to generate new private keys using another wallet and move their remaining funds immediately.
“If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible.”
The breach has also raised questions about a July network upgrade that reduced the time needed to unstake DOT from as long as 28 days to approximately one or two days.
While the change improved liquidity for token holders, it also shortened the window available to recover funds from compromised staking accounts before those assets become transferable.
The foundation said eight users had reported unauthorized transactions involving 17,286 DOT.
Blockchain security firm SlowMist identified affected extension versions as 3.0.1 and 3.0.3 through 3.0.5.
According to the firm, malicious code could collect recovery phrases, private keys and keystore files when users unlocked their wallets, transmitting the information through HTTP requests to an external server.
A remote configuration mechanism also allowed the malicious behavior to be switched on or off, potentially making it harder for users to identify the compromise.
Investigators said the offending code was removed from thewever, those changes cannot invalidate credentials attackers already exposed
Polkadot’s staking upgrade shrinks the recovery window
The Fearless Wallet disclosure comes three months after Polkadot implemented a significant change to its staking infrastructure.
Under Referendum 1910, the network eliminated slashing penalties for nominators and reduced their maximum unbonding period from 28 days to two days.
The change, which took effect on July 6, was intended to make staking more attractive by allowing participants to access their funds sooner without bearing the same slashing exposure as validators.
However, the faster withdrawals introduce a security trade-off when a wallet’s private keys fall into unauthorized hands.
Previously, an attacker initiating an unstaking request could face a waiting period of up to four weeks before the assets became transferable. That delay could provide the legitimate owner or recovery specialists with more time to identify suspicious activity and intervene.
Under the revised rules, newly initiated nominator withdrawals can become available in approximately 24 to 48 hours, depending on the network’s staking schedule.
The difference matters for holders whose compromised wallets hold staked DOT, especially when an attacker has already started the unlocking process before the owner discovers the breach.
The risk had been identified before the Fearless Wallet disclosure.
On June 30, PAPI Rescue, a recovery service developed by the polkadot-api team, warned that reducing the unbonding period from 28 days to two eras could leave insufficient time to intervene in compromised accounts unless users contacted recovery specialists promptly.
That warning preceded both the July implementation and Polkadot’s October security alert.
The foundation has since directed affected holders with constrained assets to consider PAPI Rescue before unstaking, because recovery options can change once funds become transferable.
Importantly, the shorter unbonding period has not been established as the cause of any of the unauthorized transfers
The timing also depends on individual account conditions. Unbonding requests initiated before the July upgrade retained their earlier schedules, while validators and certain other locked balances remain subject to different restrictions.
Recovery services face a narrower opportunity to protect stolen funds
The incident has brought renewed attention to specialist recovery tools designed to protect digital assets in compromised wallets.
PAPI Rescue says it has recovered more than $250,000 in assets from compromised accounts and advertises a 100% success rate among eligible cases it has handled.
Its recovery process involves verifying legitimate ownership and assessing whether Polkadot’s transaction and staking rules can still protect any remaining locked or reserved funds.
The distinction is critical because possession of a private key generally gives an attacker the same signing authority as the legitimate account holder.
As a result, recovery options depend on whether the network’s restrictions still prevent funds from being transferred and whether intervention remains technically feasible.
The July staking changes make the timing of those interventions more consequential, although the service cannot guarantee recovery and may be unable to assist once assets have moved beyond the applicable protocol constraints.
For Fearless Wallet users, the immediate priority is securing any remaining assets using entirely new credentials.
Qubic’s recovery rules require ownership checks even for unstolen funds in vulnerable wallets
Polkadot’s investigators found that the reviewed mobile applications did not contain the same malicious code identified in the browser extension. Nevertheless, users who imported exposed credentials into another application remain vulnerable because those private keys could already be known to attackers.
Changing passwords, reinstalling the compromised extension or moving the same recovery phrase into another wallet would therefore leave the underlying exposure unresolved.
The foundation has also warned users against unsolicited recovery offers and instructed them never to disclose private keys, including to recovery teams.
Affected holders with staked or otherwise locked DOT must assess their remaining withdrawal restrictions before taking action, as initiating an exit could accelerate the point at which an attacker can transfer the assets.
Once that window closes, the existence of a recovery service offers no assurance that the funds can still be secured.
Related AssetPolkadot#47DOT$1.0224-hour change: down3.98%Loading price history…24HDown3.98%7DDown7.75%30DDown14.60%
FeaturedHacksWalletsStaking
