Fearless Wallet: Extension Transmitted Private Keys to Attackers

The Polkadot Community Foundation has warned about malicious code in the Fearless Wallet extension, which could have sent users' private keys to an attacker's server since February 2025. According to the foundation, at least eight users reported unauthorized transactions, with a total volume of 17,286 DOT, estimated at $20,500. Versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 were compromised, with the malicious code entering on February 19, 2025, during a TON Ecosystem update. The code was activated at different times from February 2025 to October 10, 2026, and remains in installed versions 3.0.3-3.0.5. The malicious code has been confirmed in the Chrome version, and Firefox users are also advised to consider their keys compromised. Polkadot recommends treating all accounts used since February 2025 as compromised and suggests creating a new key pair in a different wallet. Funds in staking, pools, or votes cannot be withdrawn instantly. Users should not engage with individuals promising to help recover funds, as Polkadot does not have an official support account on social media X.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.