Fearless Wallet browser extension 3.0.1-3.0.5 leaked users' private keys to attacker server since February 2025

Summary

On 2026-10-21 the Polkadot Community Foundation published a security notice stating that the third-party Fearless Wallet browser extension had been leaking users' private keys since February 2025. Per the notice and the accompanying technical write-up by the Polkadot Technical Fellowship, extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code that, when the wallet was unlocked, collected the recovery phrase (or keystore plus password) of every main account and sent it to an external server. Fearless Wallet is not an official Polkadot wallet.

Affected

• Fearless Wallet browser extension (soramitsu/fearless-wallet-web) 3.0.1, 3.0.3, 3.0.4, 3.0.5 (Chrome confirmed; the Firefox build used the same code)
• 3.0.2 contains the code but nothing calls it, per the write-up
• Any seed phrase ever loaded into the extension, including via a Fearless Google Drive backup restored into it
• The reviewed Fearless Android and iOS apps do not contain the code
• Fixed in: no safe version; the code was removed from source on 2026-06-25, but installed copies of 3.0.3-3.0.5 still contain it and check a remote on/off switch on every unlock

Impact

An attacker who received the exfiltrated data controls the affected accounts on every chain they are used on. Per the write-up, keys were encoded with an empty password (trivially reversible) and sent in a GET request to https://tonscanner.org/whitelist?address=... . In 3.0.3-3.0.5 the server address and on/off switch came from appConfigs/web_config.json on the eth-enabled branch of the public soramitsu/shared-features-utils GitHub repository; the switch was on in nine periods between 2025-03-07 and 2026-10-10 (about 571 days) and has been off since 2026-10-10, but could be re-enabled. Exploitation in the wild is confirmed: eight users had reported unauthorised transactions totalling 17,286 DOT at publication. Changing the password or reinstalling the extension does not help.

Recommended actions

• If you used the Fearless Wallet browser extension at any time since February 2025, treat every account in it as compromised.
• Create a new keypair in a different, well-maintained wallet and move funds on every chain the old account uses; where possible, operate the old account from another wallet app instead of unlocking the Fearless extension again.
• Staked, pooled or governance-locked funds cannot be moved immediately: the notice recommends PAPI Rescue (https://www.papirescue.now) before unbonding. Never share private keys with anyone.
• Remove the extension once funds are safe.
• Beware of "recovery" scams; the notice says no legitimate party will contact you first. Losses can be reported to SEAL 911.
• Network defenders: block and alert on requests to tonscanner.org.

Source & attribution

This 0xCERT advisory summarises a security notice by the Polkadot Community Foundation (https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058), the investigation by the Polkadot Technical Fellowship (technical write-up: https://hackmd.io/@gWEUMERvQZyR5MStsH26g/HyNOm782zg), and the Polkadot alert on X (https://x.com/Polkadot/status/2112910039207800970); the incident is also recorded by SlowMist (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record.