On October 21, 2026, Polkadot warned users of the Fearless Wallet browser extension who had used versions 3.0.1, 3.0.3, 3.0.4, or 3.0.5 since February 2025 to treat all associated accounts as compromised. Malicious code introduced on February 19, 2025 through a GitHub pull request tied to the TON ecosystem intermittently sent private keys to an attacker-controlled server until at least October 10, 2026. Eight users reported unauthorized transactions totaling 17,286 DOT, while an affected version remained available in the Chrome Web Store to around 6,000 users. Funds must be transferred to newly generated keys in a different wallet, such as Nova Wallet, because updating Fearless Wallet does not revoke leaked key copies; staked or locked funds may require additional recovery steps, and users also face recovery scams.
Source: Read the original article
