Fearless Wallet extension leaked keys since Feb 2025

Not stated in the primary sources linked here.

Root cause: Malicious code in the extension. Per SlowMist: versions 3.0.1 and 3.0.3–3.0.5 contain 'malicious code designed to steal wallet recovery phrases, private keys, and keystore files when users unlock their wallets.'

Timeline, as sourced: Code shipped from Feb 2025; remote switch off since 10 Oct 2026 (per the write-up); Polkadot alert 21 Oct 2026 14:13 UTC; SlowMist alert 22 Oct 08:35 UTC.

On 21 October 2026 Polkadot (opens in a new tab) warned that, following an investigation by the Polkadot Technical Fellowship on behalf of the Polkadot Community Foundation, the third-party Fearless Wallet browser extension had been compromised and had been leaking users' private keys since February 2025. It told users to create a new keypair in a different wallet and move their funds. SlowMist (opens in a new tab) says versions 3.0.1 and 3.0.3 to 3.0.5 contain code that collects recovery phrases, private keys and keystore files when the wallet is unlocked, encrypts them with an empty password and sends them in HTTP GET requests to an outside server, with a remote configuration file switching the behaviour on and off. A technical write-up linked by SlowMist traces the code in the public source and reports that the remote switch has been off since 10 October 2026, but that installed copies of 3.0.3 to 3.0.5 still check it on every unlock. SlowMist says changing passwords or reinstalling the extension is not enough.