criticalliveunpatched

Fearless Wallet browser extension leaked private keys for ~20 months

› Fearless Wallet browser extension (Chrome; Firefox build delisted)

last updated Oct 22, 2026, 12:54 UTC

Get an email when a new major security incident drops. No spam, unsubscribe any time.

started: Feb 19, 2025
closed: ongoing
CVEs: none
sources: 2

## summary

The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.

severity: Private-key exfiltration; funds stolen (17,286 DOT reported)

## affected

3.0.1
3.0.3
3.0.4
3.0.5

## fixed in

no fixed release yet

## timeline[3]

Oct 21, 2026
Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost.
source
Oct 10, 2026
Last known period the exfiltration code was active (it could be re-enabled).
source
Feb 19, 2025
Malicious code merged into the extension's public source as part of a 'TON ecosystem' PR.
source

## advisories[1]

Security notice: Fearless Wallet browser extension - leaked private keysPolkadot Community Foundation · Oct 21, 2026

## news & write-ups[1]

Polkadot warns Fearless Wallet users to move funds after key leakCrypto Briefing · Oct 21, 2026

## notes & caveats

patchStatus 'unpatched': there is no fixed extension version; remediation is moving funds to a new key. Mobile apps reviewed do not contain the code, but any seed that was ever in the extension is compromised. Smaller-scale than other entries; include at editor's discretion.

Get notified