Polkadot Community Foundation: Fearless Wallet Browser Extension Has Private Key Leak Risk

On October 21 that the Polkadot Community Foundation issued a security warning on the Polkadot forum stating that browser plugin versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the third-party wallet Fearless Wallet contain malicious code. During wallet unlocking, private keys may be transmitted to servers controlled by attackers. The relevant code was added on February 19, 2025, via an update named "TON ecosystem," and has been activated at irregular intervals between February 2025 and October 10, 2026.

The Chrome version is confirmed to be affected, and the Firefox version uses the same code; although this code has not been detected on mobile platforms, users who previously imported the same private key into the browser plugin should also be considered compromised.

To date, eight users have reported unauthorized transactions related to this incident, involving a total of 17,286 DOT. The foundation advises users who have utilized the affected plugin since February 2025 to immediately generate new keys and transfer their assets; merely changing passwords or reinstalling the plugin will not suffice.