Odaily reports: The Polkadot Community Foundation has issued a security advisory stating that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the third-party wallet Fearless's browser extension contain malicious code that may send private keys to attacker servers when users unlock their wallets. The relevant code was active during various periods between February 2025 and October 10, 2026.
Currently, 8 users have reported unauthorized transactions potentially related to this vulnerability, involving 17,286 DOT.
The Polkadot Foundation reminds users who have used the above extensions since February 2025 to treat all accounts within them as compromised, generate new keys using other wallets, and transfer assets as soon as possible. Simply switching wallet applications, changing passwords, or reinstalling the extension will not eliminate the risk.
Upon inspection, no related malicious code was found in the Fearless Android and Apple mobile versions; however, if the mobile wallet has previously imported the same keys used by the browser extension, those keys should still be considered compromised.
