Polkadot is warning Fearless Wallet browser-extension users after four public releases were found sending private keys to an attacker-controlled server whenever the extension was unlocked. The affected versions were 3.0.1, 3.0.3, 3.0.4, and 3.0.5, available from February 2025 through October 10, 2026. Polkadot says around 6,000 users may have been exposed, with 8 confirmed unauthorized withdrawals so far totaling more than 17,000 Polkadot.
This was not a password issue. Private keys themselves were exposed, so changing a password or reinstalling the extension does not remove the risk. Anyone who used the Fearless browser extension since February 2025 should treat every account created or imported there as compromised. The same goes for any account restored in the extension with the same seed phrase or private key.
The fix is to create a new keypair in a different maintained wallet, move funds out immediately, and check for assets tied to those accounts on other chains. If possible, do not unlock the Fearless extension again, to avoid further exposure. Mobile-only users are not affected unless they entered that same seed phrase or private key into the extension.