Polkadot Foundation warns of private key leak risk in Fearless extension, 17,286 DOT involved in security incident

October 21 - The Polkadot Community Foundation has warned that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the third-party wallet Fearless's browser extension contain malicious code, and that users' private keys may be sent to an attacker's server when they unlock their wallets. The relevant code was active at various times between February 2025 and October 10, 2026. So far, 8 users have reported unauthorized transactions possibly related to the vulnerability, involving 17,286 DOT.