Fearless Wallet: browser extension shipped key-stealing code for 20 months

What happened

• 21 Oct 2026: Polkadot issued a security notice that Fearless Wallet browser extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 sent users’ private keys to an attacker server when the wallet was unlocked. Fearless is a third-party wallet, not an official Polkadot product.
• Root cause (per the notice as reported): malicious code entered through a GitHub pull request on 19 Feb 2025. The leak was intermittent and active until at least 10 Oct 2026. The Chrome Web Store still listed an affected version (about 6,000 users) at the time of the warning.
• Losses: eight users reported unauthorized transactions totaling 17,286 DOT. Exposure is wider, because leaked keys can be used later.
• Attribution: none.
• Response: Polkadot told users to treat every account used in the extension since Feb 2025 as compromised and move funds to new keys in a different wallet. No statement from Fearless was reported.

Sources

• https://cryptobriefing.com/polkadot-fearless-wallet-private-key-leak/
• https://cryptoticker.io/en/polkadot-fearless-wallet-private-key-leak/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.