The Polkadot Community Foundation warned on Oct. 21 that the third-party Fearless Wallet browser extension had leaked users’ private keys since February 2025. It said eight users had reported unauthorized transactions involving 17,286 DOT and urged extension users to create new keys in another wallet and move any remaining funds.
The disclosure raised concerns about a staking change that took effect on July 6, cutting the maximum withdrawal wait for nominators from 28 days to two days. That can leave less time to protect staked DOT in a compromised account, but the shorter wait has not been established as the cause of the reported transfers. Earlier withdrawal requests kept their original schedules, and validators and some other locked balances face different restrictions.
