The Polkadot community foundation has issued a security alert over several versions of the third-party Fearless wallet browser extension, saying they contained malicious code that could send users’ private keys to an attacker-controlled server when the wallet was unlocked. The affected versions were 3.0.1, 3.0.3, 3.0.4, and 3.0.5. According to the notice, the code was active during different periods between February 2025 and Oct. 10, 2026. So far, eight users have reported unauthorized transactions that may be tied to the issue, involving 17,286 DOT. The foundation said anyone who used the affected extension since February 2025 should treat all accounts in it as compromised, generate new keys with another wallet, and move assets as soon as possible. It also said changing the wallet app, updating a password, or reinstalling the extension would not remove the risk. Checks found no malicious code in Fearless’ Android and Apple mobile versions, though any mobile wallet that imported the same key used in the browser extension should still be treated as compromised.
Odaily reported that the Polkadot community foundation issued a security notice saying several versions of the third-party Fearless wallet browser extension contained malicious code. The affected versions were 3.0.1, 3.0.3, 3.0.4, and 3.0.5. When users unlocked the wallet, their private keys may have been sent to an attacker server.
The notice said the code was active during different periods from February 2025 to Oct. 10, 2026. So far, eight users have reported unauthorized transactions that may be linked to the vulnerability, involving 17,286 DOT.
The Polkadot Foundation said users who had used the affected extension since February 2025 should treat all accounts in it as compromised, generate new keys with another wallet, and transfer assets as soon as possible. It added that switching wallet apps, changing passwords, or reinstalling the extension would not eliminate the risk.
After checks, no related malicious code was found in Fearless’ Android and Apple mobile versions. Still, if a mobile wallet had imported the same key previously used in the browser extension, that key should also be treated as compromised.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
