# Polkadot Foundation Flags Malicious Code in Four Fearless Extension Versions

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/37312
Published: 2026-10-22T02:02:24.000Z
Updated: 2026-10-22T02:02:24.000Z
Section: Technology

> Eight users reported potentially related unauthorized transactions involving 17,286 DOT. The affected code operated at different times from February 2025 through Oct. 10, 2026.

Polkadot Foundation warned Fearless wallet users that four browser-extension releases contain malicious code that may expose private keys, putting accounts used with the affected versions at risk.

The affected releases are versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5. When a user unlocks a wallet, the code may send its private key to an attacker-controlled server. The code was active at different times from February 2025 through Oct. 10, 2026.

Eight users have reported unauthorized transactions that may be connected to the issue, involving 17,286 Polkadot (DOT). The foundation advised anyone who used one of the affected extensions from February 2025 onward to treat every account in it as compromised, create new keys with another wallet and move the assets promptly. Changing the password, reinstalling the extension or switching wallet apps without replacing the keys does not remove the exposure.

The Android and Apple mobile apps were not found to contain the malicious code. However, a key imported into a mobile wallet after being used in the browser extension should also be considered compromised.