Polkadot Community Foundation Warns of Private Key Leak in Fearless Wallet Browser Plugin

ME News reports that on October 21 (UTC+8), the Polkadot Community Foundation issued a security alert on the Polkadot forum, warning that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the Fearless Wallet browser extension contain malicious code. When users unlock their wallets, their private keys are sent to servers controlled by attackers. This code was introduced into the extension’s public source code on February 19, 2025, as part of a major code update titled "TON ecosystem," and was activated intermittently between February 2025 and October 10, 2026, with the potential to be reactivated at any time.
The affected Chrome version has been confirmed; the discontinued Firefox version used the same code. No such code has been found on Android or iOS mobile platforms, but if the same private key was ever imported into the browser extension, it should still be considered compromised. So far, eight users have reported unauthorized transactions attributable to this incident, totaling 17,286 DOT. The Polkadot Community Foundation advises all users who used this extension since February 2025 to treat all their accounts as compromised, immediately generate new key pairs in another wallet, and transfer their assets—changing passwords or reinstalling the extension will not suffice. Users whose assets are locked in staking, nomination pools, or governance voting may use the PAPI Rescue tool developed by the polkadot-api team to assist in recovery. The Polkadot Community Foundation also emphasizes that Fearless Wallet is developed and maintained by an independent team and is not an official Polkadot wallet. (Source: Foresight News)