Tin tức

The Polkadot Community Foundation has issued an official warning about malicious code in the Fearless Wallet browser extension. This extension works with the Polkadot ecosystem, but it is not an official wallet of the network. According to the organization, the code sent users' private keys to the attackers' server. The mechanism has been in operation since February 2025, although it was active in different periods until October 10, 2026. In other words, it was not a one—time error of a single update - the problem persisted in the extension for a long time.

At the time of publication, eight users had reported unauthorized transactions. The total volume of transactions amounted to 17,286 dots, approximately $20,500. The amount is not the largest for the crypto market, but the very fact of key compromise is important: if private keys get on someone else's server, not only the funds already withdrawn are at risk, but also account balances, as well as any future actions without changing keys. The Polkadot Community Foundation explicitly states: extension versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 should be considered compromised.

There is a separate history of the appearance of the code. According to Polkadot, it was added to the open source code on February 19, 2025 as part of a major TON Ecosystem update. Since then, the code has been present in the extension and could be activated at different times. It is important that it remains in the installed versions from 3.0.3 to 3.0.5 and theoretically can work again, so waiting for the problem to disappear after the update is not enough.

The Polkadot team advises that all Fearless Wallet accounts that have been used since February 2025 should be considered compromised. Changing the password or reinstalling the extension will not help: the password does not protect the keys if they have already gone to a third-party server, and reinstalling does not create a new key pair. It is safer to create a new wallet in another application and transfer funds there. This is especially important for those who kept their main assets in the extension or regularly used it.

Malicious code has been confirmed in the Chrome version. Firefox users who launched the extension during the same period should also consider the keys compromised. Even if the code is not so explicitly confirmed there, it is safer to proceed from the worst-case scenario and replace the keys.

There is also a practical limitation: funds in staking, pools, or voting cannot be withdrawn instantly, so some of the assets will remain online for a while. It is worth considering this in advance and not postponing the preparation of a new wallet. In addition, Polkadot warns against communicating with those who offer to refund funds: the project does not have an official support account in X, so any such proposals require caution.

In general, the situation shows that the security of a wallet depends not only on a password and a user-friendly interface. The browser extension has access to keys and transactions, so its source code and update history directly affect the safety of funds.