Fearless Wallet is a browser add-on for storing Polkadot coins. It is not an official Polkadot wallet. The Polkadot Community Foundation says some versions secretly sent your wallet's secret key to a thief's server when you unlocked the wallet. Hackers have already taken coins. Deleting the add-on or changing your password does not help. You have to move your money to a new wallet.
- Status
- No patch yet
- Being attacked?
- Yes[1]
- Severity
- Critical
- Updated
The Polkadot Community Foundation says 8 users reported stolen coins (17,286 DOT). Severity: Rated by us as critical: the add-on sent secret wallet keys to attackers. No official score. First reported .
Am I affected?
You are affected if you used the Fearless Wallet add-on in Chrome (or Firefox) at any time since February 2025. Open chrome://extensions to see if it is installed. Versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 are named in the notice. The Fearless phone apps were not found to have the bad code.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Fearless Wallet browser extension | Windows, Mac, Linux | Browser add-on versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 (Chrome confirmed; Firefox build uses the same code) | No safe version exists.[1] |
How to check your version
These checks only look. They do not change anything on your computer.
Fearless Wallet browser extension on Windows
Easy way: In Chrome, open chrome://extensions and look for Fearless Wallet. Click Details to see the version. In Firefox, open about:addons.
Fearless Wallet browser extension on Mac
Easy way: In Chrome, open chrome://extensions and look for Fearless Wallet. Click Details to see the version. In Firefox, open about:addons.
Fearless Wallet browser extension on Linux
Easy way: Open the app and look in its Help or About menu, or check your software manager.
How to fix it
- Make a NEW wallet in a different, trusted wallet app. Do not use Fearless for this. Foundation suggests Nova Wallet.
- Move your coins from the old account to the new one as soon as you can. Check every network the old account used.
- Do NOT unlock the Fearless add-on again if you can avoid it. If you need to move coins, use the recovery phrase in another wallet app.
- If your coins are staked or locked, follow the foundation's notice for steps.
- Ignore anyone who messages you offering to 'recover' your coins. They are scammers.
More on each app: Is my Fearless Wallet up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/fearless-wallet-extension-leaks-private-keys.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): None
Sources
- Official noticePolkadot Community Foundation: Security notice, Fearless Wallet browser extension leaked private keys (Oct 21, 2026)
- Researcher0xCERT advisory 0xCERT-2026-0266 (Oct 21, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.