The Polkadot Community Foundation warned on Oct 21 that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the third-party Fearless Wallet browser extension contained code that sent the user's private key to an attacker-run server whenever the wallet was unlocked.

• The code entered the extension's public source on Feb 19, 2025, inside a large pull request titled "TON ecosystem", and was active at different times until Oct 10, 2026. The foundation says it could be switched on again.
• Confirmed in the Chrome build. The delisted Firefox build used the same code. The reviewed Android and iOS apps don't contain it, but any key that was ever in the extension is compromised everywhere.
• Eight users have reported unauthorized transfers totaling 17,286 DOT so far.

Supply-chain lesson: malicious code sat in plain sight in an open-source repo for months because it was buried in a huge feature PR. Do now: if you used the extension, create a new keypair in a different wallet and move funds. Changing the password or reinstalling doesn't help. Ignore anyone offering "recovery".