Polkadot tells Fearless Wallet extension users to move funds after a 20-month key leak

The Polkadot Community Foundation warned on October 21, 2026 that anyone who used the Fearless Wallet browser extension since February 2025 should treat all accounts in it as compromised and move funds immediately. A security notice says code in builds 3.0.1, 3.0.3, 3.0.4 and 3.0.5 sent recovery phrases and wallet passwords to tonscanner.org after an unlock with the correct password. The foundation lists eight users reporting 17,286 DOT in unauthorized transfers, though its case log says the reports do not prove theft. Fearless Wallet is a third-party app from an independent team and was never an official Polkadot wallet, the foundation said.