Polkadot cut staking exit delays from 28 days to roughly 48 hours, improving liquidity while reducing the time available to recover assets from compromised wallets.

Polkadot's Fearless Wallet security breach has exposed a potential weakness in the network's recently shortened staking withdrawal period.

The Polkadot Community Foundation warned on Oct. 21 that the third-party Fearless Wallet browser extension had been leaking users' private keys since February 2025, potentially exposing their assets to unauthorized transfers.

The disclosure followed an investigation by the Polkadot Technical Fellowship, which identified malicious code capable of extracting wallet credentials. The foundation urged affected users to generate new private keys using another wallet and move their remaining funds immediately.

“If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible.”

The breach has also raised questions about a July network upgrade that reduced the time needed to unstake DOT from as long as 28 days to approximately one or two days.

While the change improved liquidity for token holders, it also shortened the window available to recover funds from compromised staking accounts before those assets become transferable.

The foundation said eight users had reported unauthorized transactions involving 17,286 DOT.

Blockchain security firm SlowMist identified affected extension versions as 3.0.1 and 3.0.3 through 3.0.5.

According to the firm, malicious code could collect recovery phrases, private keys and keystore files when users unlocked their wallets, transmitting the information through HTTP requests to an external server.

Source link