The Polkadot Foundation has issued a security alert covering four versions of the Fearless Wallet browser extension after identifying malicious code capable of transmitting private keys to an external server. The affected releases are 3.0.1, 3.0.3, 3.0.4 and 3.0.5. The code activates when a user unlocks a wallet, creating an exposure window for any accounts managed through those builds.

Eight users reported unauthorized transactions that appear linked to the problem. The reported activity involves 17,286 DOT. The foundation stated that the malicious code operated across separate intervals running from February 2025 through October 10, 2026, rather than as a single continuous period for every version.

Recommended Response for Affected Users

Anyone who used one of the listed extension versions from February 2025 onward is advised to treat every account inside it as compromised. The foundation directed holders to generate entirely new private keys in a different wallet and transfer assets to those new addresses without delay. Changing a password, reinstalling the extension or moving to another application without replacing the keys does not eliminate the risk once a key has been sent.

Chrome’s listing for one of the affected extension versions continued to show approximately 6,000 users at the time of the alert. The foundation’s guidance centers on key replacement paired with an immediate transfer of funds out of any wallet tied to the exposure.

Mobile Applications and Imported Keys

Checks of the Android and iOS versions of Fearless Wallet found no presence of the malicious code. However, any private key that was first used in an affected browser extension and later imported into a mobile app must still be regarded as compromised. The foundation’s advice applies equally to those imported keys: generate fresh credentials and move the associated assets.

Fearless Wallet is a third-party product. The warning is limited to the named browser-extension releases and the specific unlock-triggered behavior described by the foundation. No other technical details beyond the private-key transmission risk and the listed version numbers were provided in the alert.

The foundation’s notice focuses on practical steps for holders rather than broader claims about the wallet’s overall security record. The reported unauthorized activity remains limited to the eight cases and the 17,286 DOT figure cited in the warning.