Polkadot warns Fearless Wallet users to move funds after key leak

Polkadot has a blunt message for anyone who used the Fearless Wallet browser extension since February 2025: assume your accounts are compromised, and move your funds. The warning came in a security notice published on October 21, 2026. It describes a flaw that quietly shipped users’ private keys to a server controlled by an attacker. The flaw had been live, on and off, for roughly a year and a half. What went wrong inside the extension According to Polkadot’s notice, four versions of the Fearless Wallet extension were handing out copies of that master key. The affected releases are 3.0.1, 3.0.3, 3.0.4, and 3.0.5. When a user unlocked the wallet, the extension sent their private key to an attacker-controlled server. The malicious code entered the project on February 19, 2025. It arrived through a GitHub pull request tied to the TON ecosystem. The leak did not run continuously. Polkadot said it was active intermittently until at least October 10, 2026. That stretch covers more than 19 months of potential exposure for anyone running the compromised builds. The damage so far is concrete. Eight users have reported unauthorized transactions linked to the exploit, totaling 17,286 DOT. Bec...