Polkadot has issued a security warning regarding the third-party Fearless Wallet browser extension. Four versions of the software—3.0.1, 3.0.3, 3.0.4, and 3.0.5—contained malicious code that transmitted private keys to an attacker-controlled server.
The vulnerability originated from a GitHub pull request on February 19, 2025, and remained active intermittently until at least October 10, 2026. At the time of the warning, the Chrome Web Store listed approximately 6,000 users for the affected extension.
To date, eight users have reported unauthorized transactions, with losses totaling 17,286 DOT. Polkadot emphasizes that Fearless Wallet is a third-party product and not an official network tool.
Users who interacted with the extension since February 2025 are advised to assume their accounts are compromised. The recommended course of action is to generate new keys in a different wallet, such as Nova Wallet, and transfer all funds immediately.
Updating the extension does not mitigate the risk, as attackers already possess the leaked keys. For staked or locked assets, the foundation suggests using specialized tools like PAPI Rescue and warns users to be vigilant against recovery scams.
