Foundation warns browser users to replace exposed accounts

The Polkadot Community Foundation’s 21 October notice says anyone who used the Fearless browser extension since February 2025 should treat its accounts as compromised and create fresh keys elsewhere. It identifies versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5, and reports eight users with potentially related unauthorised transactions totalling 17,286 DOT. NetNapz has not independently reconstructed those losses.

The warning covers Chrome and advises Firefox users to assume exposure too. Reviewed mobile builds lacked the offending code, but a key previously imported into the extension remains exposed wherever reused. Fearless is an independently maintained third-party application.

Technical analysis distinguishes source removal from installed copies

The technical analysis linked by the Foundation describes an unlock-triggered routine that gathered recovery phrases or keystore files and passwords, applied reversible encryption with an empty password, and transmitted the result to an external server.

It says versions 3.0.3–3.0.5 used a remote configuration switch. Removal from the source in June 2026 did not remove code from installed copies; the switch was off from 10 October but could be restored. The analysis reports matching code in downloaded Chrome packages for those three versions. Earlier packages and Firefox binaries could not be recovered, limiting direct package verification.

The repository’s pull request #1022 separately confirms a merge on 19 February 2025. A merge record alone does not identify who was responsible for harmful behaviour or establish intent.

Why changing applications alone is insufficient

The Foundation says a password change or reinstall cannot revoke a leaked key. It advises moving assets to a newly generated account, checking other chains using the same keys, and preserving transaction evidence. Staking and other locks may complicate transfers. Its notice links specialist assistance and warns against unsolicited recovery messages or sharing secret keys.

NetNapz assessment: the critical distinction is between replacing software and replacing signing authority. Importing an old seed into a new application preserves the old account’s authority; anyone holding that seed may still sign. Recovery should therefore be judged by whether assets and permissions have moved to fresh keys, rather than whether a different wallet interface is installed.

The disclosure concerns wallet software and account-key exposure. The reviewed evidence does not establish a compromise of Polkadot consensus. Attribution, the complete affected population and aggregate losses remain unresolved.