Fearless Wallet extension leaked private keys for 20 months

The Polkadot Community Foundation has issued a security warning regarding the Fearless Wallet browser extension, which leaked users' private keys to an attacker's server for approximately 571 days. The malicious code was active intermittently between February 19, 2025, and October 10, 2026.

The vulnerability affected browser extension versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5. When a user unlocked the wallet with a password, the extension gathered recovery phrases or backup files and transmitted them to an external site. While the code was not found in the Android or iOS mobile applications, the foundation warned that any private key previously used within the compromised extension is considered at risk.

Users are urged to create entirely new wallets and move their funds immediately. The foundation noted that simply changing passwords or reinstalling the extension will not mitigate the risk. For assets currently locked in staking or governance, the foundation suggested exploring the ‘PAPI Rescue’ service for assistance.