Fearless Wallet extension sent private keys on unlock since Feb 2025
5 sent the user's private key to an attacker server when the wallet was unlocked. The code was added on 19 Feb 2025 and could be switched on through 10 Oct 2026. Eight users have reported 17,286 DOT stolen.
Mobile apps that were reviewed do not contain the code. A key that was ever imported into the extension is treated as exposed on every chain it touches. Research snapshot from the Polkadot Community Foundation.
369 take
If you ever unlocked that extension, make a new wallet with a new seed and move funds. A password change or a reinstall keeps the same seed. Ignore recovery DMs.
Sources