{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "fearless-wallet-extension-leaks-private-keys",
  "url": "https://patchgap.ai/incidents/fearless-wallet-extension-leaks-private-keys/",
  "path": "/incidents/fearless-wallet-extension-leaks-private-keys/",
  "json_url": "https://patchgap.ai/incidents/fearless-wallet-extension-leaks-private-keys.json",
  "title": "Fearless Wallet browser add-on stole users' wallet keys. There is no safe version.",
  "category": "wallets",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "fearless-wallet-extension"
  ],
  "status": "no-patch",
  "status_label": "No patch yet",
  "severity": "critical",
  "severity_source": "Rated by us as critical: the add-on sent secret wallet keys to attackers. No official score.",
  "exploited_in_wild": "yes",
  "exploited_note": "The Polkadot Community Foundation says 8 users reported stolen coins (17,286 DOT).",
  "exploited_source_url": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-21",
  "updated_at": "2026-10-27",
  "cves": [],
  "summary": "Fearless Wallet is a browser add-on for storing Polkadot coins. It is not an official Polkadot wallet. The Polkadot Community Foundation says some versions secretly sent your wallet's secret key to a thief's server when you unlocked the wallet. Hackers have already taken coins. Deleting the add-on or changing your password does not help. You have to move your money to a new wallet.",
  "am_i_affected": "You are affected if you used the Fearless Wallet add-on in Chrome (or Firefox) at any time since February 2025. Open chrome://extensions to see if it is installed. Versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 are named in the notice. The Fearless phone apps were not found to have the bad code.",
  "action": "Fearless Wallet add-on: move your coins to a new wallet now",
  "affected": [
   {
    "product": "fearless-wallet-extension",
    "product_name": "Fearless Wallet browser extension",
    "platform": "windows",
    "affected_versions": "Browser add-on versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 (Chrome confirmed; Firefox build uses the same code)",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "No safe version exists.",
    "fixed_source_urls": [
     "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058"
    ],
    "check": {
     "menu_path": "In Chrome, open chrome://extensions and look for Fearless Wallet. Click Details to see the version. In Firefox, open about:addons.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": null
   },
   {
    "product": "fearless-wallet-extension",
    "product_name": "Fearless Wallet browser extension",
    "platform": "macos",
    "affected_versions": "Browser add-on versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 (Chrome confirmed; Firefox build uses the same code)",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "No safe version exists.",
    "fixed_source_urls": [
     "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058"
    ],
    "check": {
     "menu_path": "In Chrome, open chrome://extensions and look for Fearless Wallet. Click Details to see the version. In Firefox, open about:addons.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": null
   },
   {
    "product": "fearless-wallet-extension",
    "product_name": "Fearless Wallet browser extension",
    "platform": "linux",
    "affected_versions": "Browser add-on versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 (Chrome confirmed; Firefox build uses the same code)",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "No safe version exists.",
    "fixed_source_urls": [
     "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058"
    ],
    "check": {
     "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": null
   }
  ],
  "fix_steps": [
   "Make a NEW wallet in a different, trusted wallet app. Do not use Fearless for this. Foundation suggests Nova Wallet.",
   "Move your coins from the old account to the new one as soon as you can. Check every network the old account used.",
   "Do NOT unlock the Fearless add-on again if you can avoid it. If you need to move coins, use the recovery phrase in another wallet app.",
   "If your coins are staked or locked, follow the foundation's notice for steps.",
   "Ignore anyone who messages you offering to 'recover' your coins. They are scammers."
  ],
  "official_patch_links": [
   {
    "label": "Polkadot Community Foundation notice",
    "url": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058",
    "title": "Polkadot Community Foundation: Security notice, Fearless Wallet browser extension leaked private keys",
    "date": "2026-10-21",
    "kind": "primary",
    "official": true
   },
   {
    "url": "https://www.0xcert.com/advisory/0xCERT-2026-0266",
    "title": "0xCERT advisory 0xCERT-2026-0266",
    "date": "2026-10-21",
    "kind": "research",
    "official": false
   }
  ]
 }
}