Fearless browser extension exposed wallet keys

What happened

A Polkadot Community Foundation notice links eight user reports, totalling 17,286 DOT, to malicious code in the Fearless Wallet browser extension. The code sent private keys away when an affected wallet was unlocked.

The 21 October notice identifies versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5. It dates the code’s introduction to 19 February 2025, with intermittent activation through 10 October 2026. The reviewed mobile builds were separate from the affected extension. Exposed keys remain compromised when imported into another app, so affected users need new keys. The loss reports are denominated in DOT.