Fearless Wallet browser extension leaked private keys: move funds to a new wallet

On October 21, 2026, the Polkadot Community Foundation disclosed that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the third-party Fearless Wallet browser extension contained malicious code that sent recovery phrases and account backups to an external server whenever a user unlocked their wallet. The code was added to the extension's public source repository on February 19, 2025, under a change labeled TON ecosystem, and operated intermittently through October 10, 2026. Installed copies of versions 3.0.3 through 3.0.5 still contain the code, which could be switched back on remotely, and version 3.0.5 remained listed on the Chrome Web Store with roughly 6,000 users at the time of the warning. Anyone who used the Fearless Wallet extension on Chrome or Firefox at any point since February 2025 is affected. Fearless Wallet is an independent multi-chain application, not an official Polkadot wallet. While the reviewed Android and iOS mobile apps did not contain the malicious code, any private key or recovery phrase that was ever created in or imported into the browser extension is exposed even if you now only use it on a phone. The flaw has already been exploited in the wild. At least eight users have reported unauthorized withdrawals linked to the leak, totaling 17,286 DOT, worth about $20,500. Because a leaked private key remains valid indefinitely, attackers can drain exposed accounts at any time without needing your wallet password. - Assume every account ever loaded into the Fearless Wallet browser extension since February 2025 is compromised. - Create a brand-new recovery phrase and private key in a different wallet app, such as Nova Wallet or a hardware wallet, and transfer all transferable balances to the new address right away. - Do not simply change your password, reinstall the extension, or import your old recovery phrase into another wallet app, because the attacker already has a copy of the underlying key. - If you have tokens locked in staking, nomination pools, or governance, seek assistance from the Polkadot API team's PAPI Rescue tool before unstaking so an attacker cannot sweep the funds when they unlock, and remove the extension once your assets are safe. - Never share your recovery phrase or private keys with anyone, including recovery helpers, and ignore unsolicited messages offering to recover stolen crypto.