On October 21, 2026, an account called pcf_network published a security notice on the official Polkadot Forum. It opens with a sentence wallet users rarely see from a foundation: assume that every account in the Fearless Wallet browser extension is compromised.

Fearless Wallet, built by Soramitsu, was never an official Polkadot wallet — the notice takes care to say so twice. It was a popular third-party option for Polkadot and Kusama accounts, with a browser extension and mobile apps. The notice concerns only the browser extension: versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code that quietly shipped users’ private keys to a server controlled by an attacker.

Eight users have so far reported unauthorized transfers that can be attributed to the exploit, totalling 17,286 DOT — roughly US$20,000 at recent prices. Individual reports are being tracked publicly.

What the Malicious Code Actually Did

A technical analysis published alongside the notice walks through the extension’s public source code, commit by commit. The behaviour is more deliberate than a typical infostealer:

  1. Trigger. Every time you unlocked the wallet — a successful unlock, that is — a background function named fetchJettonInfo() ran. The name suggests fetching TON token (“jetton”) metadata. It did not.
  2. Remote switch. The function first downloaded a configuration file from a separate public GitHub repository (soramitsu/shared-features-utils, branch eth-enabled, file web_config.json). If the file’s ton field was empty, nothing happened. If it held a server address, the next steps ran. This gave the attacker an on/off switch that could enable the exfiltration at chosen moments — and the switch stayed off at times, which is presumably why the damage stayed small relative to the exposure window.
  3. Key collection. The code gathered the private keys of every main account in the wallet: the recovery phrase, or the keystore file together with the wallet password.
  4. Fake encryption. The keys were encrypted with an empty password — a container anyone can open. This step exists purely to look like normal key handling.
  5. Exfiltration. The encrypted keys were appended to the URL of a web request and sent to https://tonscanner.org — a domain dressed up to look like a TON blockchain explorer. To anyone glancing at network logs, it was a token-info lookup.

Version 3.0.1 worked slightly differently: the server address was hardcoded, and a date check delayed activation until February 26, 2025 — a week after the code landed. The code was removed from the public repository on June 25, 2026, but the remote switch was only turned off on October 10, 2026, and copies of versions 3.0.3 to 3.0.5 still installed in browsers still contain the code and still check the switch on every unlock.

Why the Fearless Wallet Hack Stayed Invisible for 20 Months

The Fearless Wallet hack was not a compromised build server or a stolen signing key. The malicious code was merged into the extension’s public, open-source repository on February 19, 2025, as part of a large commit titled “TON ecosystem” (PR #1022). The release pipeline then shipped properly signed, store-approved packages containing it — the analysis verified that the Chrome Web Store packages of 3.0.3 through 3.0.5 match the repository.

That is the uncomfortable part. Every layer that users are told to trust did its job:

  • The code was public and inspectable for the entire 20 months.
  • The packages were signed and delivered by the official Chrome Web Store.
  • The Firefox build came from the same source (it has since been delisted).

Nothing was forged. The camouflage was naming and context: an exfiltration routine hidden inside a “jetton info” service, a TON-themed destination domain, a config read from the vendor’s own infrastructure repo. Open source only helps if someone actually reads the diff — and in a wallet used by thousands, for twenty months, effectively nobody did. It is the browser-extension sibling of the npm supply-chain attacks we tracked earlier this year: the repository, not the package registry, is the attack surface.

If You Used the Extension: the Notice’s Checklist

The Polkadot Community Foundation’s guidance is unusually specific, and worth following in order:

  1. Create a new keypair in a different, well-maintained wallet — the notice suggests Nova Wallet — not Fearless.
  2. Move your funds from every account that was ever in the extension, checking every chain it used. If possible, operate through another wallet app with your private key rather than unlocking the Fearless extension again. Users reported funds leaving the moment they unlocked.
  3. Mobile users should still migrate: even though the reviewed Android and iOS builds are clean, a seed phrase that ever touched the extension is burned wherever you use it.
  4. Staked funds cannot move immediately — Polkadot unbonding takes one to two days. Before unstaking from a compromised account, consider PAPI Rescue, built by the polkadot-api team for exactly this situation. Never share keys with anyone, including them.
  5. Then remove the extension. Installed copies of 3.0.3–3.0.5 still poll the kill switch on every unlock.

Changing your Fearless password, or reinstalling the extension, does not help. An account is controlled by its seed phrase, not by the app around it; once the phrase has left the device, the account is the attacker’s to take at any time.

Warning Signs Your Account Is Being Worked On

From the notice — act immediately (move what can move, contact PAPI Rescue) if you see any of these and did not do them yourself:

  • Staking stopped, or stake began unbonding on its own
  • Staking reward destination changed
  • Your account left a nomination pool, or a governance vote vanished
  • Small test transfers leaving the account — the classic sizing-up step before a full sweep

The Pattern: Extension Supply Chain Is the Soft Underbelly

This is the second browser-extension wallet compromise in under a year that followed the same shape — legitimate vendor, public repository, malicious code riding a normal feature update, remote-controlled activation. It pairs with the tampered hardware wallets we documented: both prove that the dangerous moment is not a exotic zero-day, but the update channel itself.

Three habits follow for anyone holding self-custodied funds:

  • Treat wallet extensions as hot wallets by definition. If a balance would hurt to lose, it should not live behind a browser that auto-updates code you have never read.
  • Watch for the quiet on-chain signals — unbonding, reward-destination changes, tiny outbound transfers — not just for missing balances. Attackers stage before they sweep; the staging is visible on-chain, which is exactly where post-drainer response begins.
  • Distrust recovery agents. The notice repeats it in bold, and so will we: no legitimate person messages you first offering to recover funds, and nobody needs your private keys to help you. After an incident like this, the scavengers arrive before the dust settles.

If you lost funds, the notice recommends preserving evidence (addresses, transaction hashes, dates, amounts), reporting to SEAL 911, and filing a police report — the latter matters when the trail reaches a centralized exchange.

Frequently Asked Questions

Was the Fearless Wallet hack caused by a broken extension store review?

No. The malicious code was committed to the extension's own public GitHub repository on February 19, 2025, inside a large feature change titled 'TON ecosystem' (PR #1022), and then shipped through the normal, properly signed release pipeline. Chrome Web Store packages of versions 3.0.3 to 3.0.5 were verified to contain the same code as the repository. The failure was not a forged package — it was that nobody reviewed what a legitimate-looking feature commit actually did.

Is the Fearless Wallet mobile app affected by the key leak?

According to the Polkadot Community Foundation notice, the reviewed Android and iOS builds do not contain the malicious code. But a seed phrase is compromised wherever it has been. If you ever restored the same recovery phrase into the browser extension — for example by importing a Google Drive backup — every account derived from that phrase should be treated as compromised.

What should Fearless Wallet extension users do right now?

Create a new keypair in a different, well-maintained wallet (the notice suggests Nova Wallet), move all funds from the old account to the new one — checking every chain it used — and only then remove the extension. If funds are staked or in a nomination pool they cannot move immediately; the polkadot-api team's PAPI Rescue tool helps recover funds still sitting in a compromised account. Never share your private keys with anyone, including self-described recovery agents.

How do I know if my Fearless account is already being drained?

The notice lists warning signs: staking that stops or starts unbonding on its own, a changed reward destination, leaving a nomination pool without your action, small test transfers leaving the account, or any on-chain action you did not take yourself. If you see one, move whatever can be moved immediately and contact PAPI Rescue.