blockintAI · Research blog

Unlock, Then Leak: The Fearless Wallet Extension Sent Polkadot Recovery Phrases to tonscanner[.]org for 20 Months

BlockintAI · 2026-10-22T12:59:24.246Z

BlockintAI research. Code, GitHub history, the Chrome Web Store listing, domain records and the reported on-chain transfers were re-checked on Thursday, October 22, 2026, between about 7:00 AM and 7:15 AM Central Time (CT). Times are CT unless marked UTC.

On September 30, 2025, 260.05 DOT left a Polkadot account at 8:37 AM CT. The owner hadn't sent it. Six days later they posted a warning on the Polkadot Forum, with timestamps showing the coins split and moved on again within about ten minutes. The money went, they wrote, "immediately following a recent update" of their Fearless Wallet, and their 12-word recovery phrase had never been typed into any website.

A reply the next morning said no app vulnerability had been confirmed. It added that Polkadot Support was looking into it, and that there had been no other reports like it.

A year later, there is a confirmation. At 9:00 AM CT on October 21, 2026, the Polkadot Community Foundation posted a security notice. Thirteen minutes later the main Polkadot account repeated it on X. Their finding: the Fearless Wallet browser extension had been leaking users' private keys since February 2025. If you ever used it, they said, assume every account in it is compromised. Create a new keypair in a different wallet and move your funds.

This post explains how the leak worked, what the published code shows, what is known about losses, and what extension users should do now.

Key facts
What The Fearless Wallet browser extension, a third-party wallet for Polkadot, Ethereum and TON, sent users' secrets to an outside server when they unlocked it
What was sent The recovery phrase of each main account, or the account's keystore (backup) file together with the wallet password in plain text
Where it went tonscanner[.]org, in web requests to a /whitelist address. The data was "encrypted" with an empty password, so anyone can reverse it
Affected versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 (Chrome confirmed; the delisted Firefox version used the same code). The reviewed iOS and Android apps don't contain it
Exposure window February 2025 to October 10, 2026, switched on and off remotely from a file in a public GitHub repository
Chrome extension ID nhlnehondigmgckngjomcpcefcdplmgc (named by SlowMist as the malicious extension)
Reported losses Eight users have reported unauthorized transactions totaling 17,286 DOT, according to the Foundation's notice; SlowMist's Hacked database repeats that figure and puts the loss at $20,000. The Foundation's case log lists eight cases from September 2025 to September 2026 totaling 15,571.99 DOT plus 54,450.36 DED, 1,714.01 DOT less than the notice; neither explains the gap
The domain tonscanner[.]org was registered on February 17, 2025, through PDR Ltd. (PublicDomainRegistry), two days before the code first appeared in the extension's source. It still resolved on October 22, 2026
Today's listing The Chrome Web Store listing under that ID showed version 3.0.6, updated October 22, 2026, and "6,000 users" at 7:04 AM CT
What to do Make a new recovery phrase in a different wallet and move everything. Changing the password or reinstalling the extension does not help

The warning

The Foundation's notice is blunt. "If you have used the Fearless Wallet browser extension since February 2025, assume that every account in it is compromised." Fearless Wallet, it says, "is a third-party application, built and maintained by an independent team. It is not, and has never been, an official Polkadot wallet."

The finding came out of an investigation by the Polkadot Technical Fellowship on behalf of the Foundation. Per the notice, the code was added to the extension's public source on February 19, 2025, inside a large change titled "TON ecosystem." When a user unlocked the wallet, "it sent your private key to a server run by the attacker." It was active at different times between February 2025 and October 10, 2026, "and it could be enabled again at any point in time."

The Polkadot account on X put the same message out at 2:13 PM UTC (9:13 AM CT) on October 21. It ends: "If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible."

At 3:35 AM CT on October 22, the security firm SlowMist issued its own alert. It called the extension malicious, with "a threat exposure period spanning nearly 20 months, from February 2025 to October 2026." It named versions 3.0.1 and 3.0.3 to 3.0.5, tonscanner[.]org as the destination, and the Chrome extension ID above. Its advice: "Changing passwords or reinstalling the extension is insufficient."

How it worked: a function called fetchJettonInfo

The Foundation linked a technical write-up that walks through the code line by line, with links to fixed commits in the extension's public repository, soramitsu/fearless-wallet-web. It describes behaviour only. It does not say who wrote the code or why. BlockintAI read the same files on GitHub on October 22 and confirmed the key lines quoted below.

1. Unlocking starts it. When you type your password, the extension's background process runs unlockKeyring. Right after it tries the password, it calls fetchJettonInfo(). In TON, "jettons" are tokens, so the name suggests a harmless token lookup. It isn't one. The call happens on every unlock attempt. Only an unlock with the correct password leads to anything being sent, because a wrong password can't decrypt any key.

2. It checks a remote switch. In versions 3.0.3 to 3.0.5, the function first downloads a small settings file from a separate public GitHub repository, soramitsu/shared-features-utils, at eth-enabled/appConfigs/web_config.json. If that file has a ton value, the code carries on and uses it as the destination. If not, it stops. BlockintAI opened the file at the commit from May 15, 2025, that the write-up points to. Next to ordinary settings for card and fiat on-ramp features, it reads "ton": "https://tonscanner[.]org" (defanged here).

3. It collects every main account's secret. For each main account in the wallet, the code pulls one of three things:

  • for a TON account, the recovery phrase;
  • for a Polkadot or other Substrate account with a recovery phrase, the recovery phrase;
  • for other accounts, the account's keystore file followed by the wallet password in plain text, plus the linked Ethereum account's keystore and password where there is one.

4. It "encrypts" with an empty password. Each secret goes through CryptoJS.AES.encrypt(value, ''). With an empty passphrase, anyone who sees the result can turn it back into the original. It hides nothing from the server, or from anyone who logs the request.

5. It sends it in the web address. The values are joined together and put into a GET request to <destination>/whitelist?address=…. With the switch on, that is tonscanner[.]org. Because the secrets sit in the address itself, they can also end up in server access logs. Any error ends the function silently. The user sees nothing.

6. It sends each account once. Version 3.0.5 records the sent accounts in the extension's local storage under myAddresses, so the same account isn't sent twice.

Version 3.0.1 was cruder, per the write-up. It had the tonscanner[.]org address written straight into the code, and a date check that kept it quiet until February 26, 2025, at 20:00 UTC. It also ran when an account was created or imported, not only on unlock, and it sent every time. BlockintAI confirmed that version 3.0.1's source has baseUrl set to the tonscanner[.]org address and the timing constant that works out to that date.

The timeline

All dates come from the extension's public GitHub history and the write-up. GitHub dates are UTC.

Date What happened
Feb 17, 2025 tonscanner[.]org is registered through PDR Ltd. (RDAP)
Feb 19, 2025 The code is added to the source in pull request #1022, "Ton Service," merged as the "TON ecosystem" commit
Feb 26, 2025 Release 3.0.1, with the server address hard-coded and a start date of Feb 26, 2025, 20:00 UTC
Mar 7, 2025 Release 3.0.3 adds the remote switch
Apr 8, 2025 Release 3.0.5 (live on the Chrome Web Store from April 9, per the write-up)
May 15, 2025 The switch file gets the tonscanner[.]org value for its last, unbroken "on" period
Sep 30, 2025 First case in the Foundation's log: 260.05 DOT taken from a user running extension 3.0.5
Jun 25, 2026 The code is removed from the source in a commit titled "Release web wallet readiness updates"
Oct 10, 2026 The switch is turned off: a commit titled "Restore web_config.json to its previous content" removes the ton value (9:11 AM CT)
Oct 21, 2026 Foundation notice (9:00 AM CT) and Polkadot alert on X (9:13 AM CT)
Oct 22, 2026 SlowMist alert (3:35 AM CT). The Chrome Web Store listing shows version 3.0.6, updated the same day

The write-up says GitHub's activity log shows the switch turned on in nine separate periods between March 7, 2025, and October 10, 2026, about 571 days in all. The earlier states were overwritten with force pushes, so only the last period shows in the branch's normal history. BlockintAI confirmed the last "on" state (May 15, 2025) and the "off" state (October 10, 2026), which is still the branch's latest commit.

Note the gap. The code left the source in June 2026, but the switch stayed on until October 10. Removing code from a repository doesn't remove it from copies people have already installed. In the Foundation's words, "The offending code is still in installed copies of versions 3.0.3 to 3.0.5, and it could be switched on again." Anyone who still has one of those versions will fetch that settings file on every unlock.

The domain

tonscanner[.]org sounds like a block explorer for the TON blockchain. Its registration record (RDAP) shows it was created on February 17, 2025, at 1:12 PM CT, through PDR Ltd. d/b/a PublicDomainRegistry.com. It is registered until February 17, 2027, and was last changed on August 11, 2026. Its name servers are at Beget, and on the morning of October 22 it resolved to 31.129.104.153, an address the RIPE registry lists in a Beget network in Russia. Its only status is "client transfer prohibited." That is a routine lock, not a hold or a suspension.

Two days after the domain was registered, the code that sends secrets to it appeared in the extension's source.

The 3.0.6 update

On October 21, news coverage reported that the Chrome Web Store still offered version 3.0.5. By the morning of October 22, the listing under the same ID showed version 3.0.6, "Updated October 22, 2026," with 6,000 users. That is a store count of users. It isn't a count of compromised accounts.

BlockintAI downloaded the 3.0.6 package the store served at about 7:04 AM CT on October 22. It contains no reference to tonscanner[.]org, the switch file's eth-enabled path, the /whitelist?address= request or the myAddresses list.

That doesn't change the advice. An update can stop future leaks. It can't call back a recovery phrase that was already sent. If your extension unlocked while the switch was on, the secret left your machine then.

Who lost money

The Foundation says eight users "have reported unauthorised transactions that could be attributed to this exploit, totalling 17,286 DOT." SlowMist's Hacked database lists the incident on October 21, 2026, with a loss of $20,000 and the attack method "Private Key Leakage."

The Foundation's notice links a public case log that lists each case's account and the transfers out, with links to Subscan, a free Polkadot block explorer. The log is careful. It lists a case only when the holder reported it publicly, said they used Fearless Wallet, and the reported transactions could be found on-chain. "On its own," it says, a listing "does not establish how each account's keys were exposed." It also says the cases are "not the full extent of the problem," and that it has found more accounts with the same on-chain pattern whose holders haven't come forward.

The case log's own summary gives 15,571.99 DOT transferred out across the eight cases, plus 54,450.36 DED, a Polkadot token; the log's eight rows add up to the same figure. The Foundation's notice gives 17,286 DOT, and SlowMist's Hacked database repeats that number. The notice's figure is 1,714.01 DOT higher than the case log's total. Neither document explains the difference, so both figures are given here.

BlockintAI opened each of the eight main transfers on Subscan on October 22. All eight are there, with the dates and amounts the log gives:

# Transfer out (CT) Chain Amount Receiving address
1 Sep 30, 2025, 8:37 AM Polkadot 260.05 DOT 16DBDAH1xPREi63NcxpKnAfDVmdDoZMbuvi2MepPtwdtZZZK
2 Oct 30, 2025, 7:15 AM Polkadot 2,157.42 DOT 1udhVckiUreaw49zN8wmneWPZBCGtaquQz35w7RfZZ9wmRa
3 Nov 30, 2025, 11:27 AM Polkadot 490.10 DOT (+4.00 DOT to a second address) 1dwJuADqY9rNcZA5PDdDqRMbXQhxLA49jCFy7hwW7wGsn6Z
4 Sep 10, 2026, 6:46 AM Polkadot Asset Hub 221.70 DOT 148fzdn5DeFW4JcrATqDuXkxcVKh8mSfN4tar3ctS7Ev5K74
5 Sep 12, 2026, 6:48 AM Polkadot Asset Hub 1,918.73 DOT (+54,450.36 DED) 15V28W6hcMmYNkXqf8W9mSipK1EuUPDLFwEYuVL7aHBVW4GK
6 Sep 12, 2026, 6:55 AM Polkadot Asset Hub 374.00 DOT 1UTyHdLnXSLWbewZCyifu26Lcc7g29xUMmrST5WaqqkrVGR
7 Sep 15, 2026, 6:36 AM Polkadot Asset Hub 1,150.43 DOT 1eHXNhMEop6pW444Q6Fe7RnBxrb2UaH8FbjzhaMX4EgGAQY
8 Sep 23, 2026, 6:36 AM Polkadot Asset Hub 8,994.00 DOT (+1.56 DOT) 136LEd5L2QRR9XHduhnTrp5ttTwFcR24f4iDsRdzqxaVYzVj

Each case went to a different receiving address. On October 22, Subscan showed none of the nine receiving addresses (the eight above plus case 3's second address, 1du2ZBnyWhqUj8ov2mE6FME1DMBdF7GaehXfvDGQsa8JJw6) with a label or an on-chain identity. None appears in OFAC's sanctions list. Public sources name no person or group as the receiver.

One pattern stands out. All five main transfers from September 2026 went out in the same 20-minute window of the day, between 6:36 AM and 6:55 AM CT (11:36 to 11:55 UTC in Subscan's block times), on four different days. BlockintAI's reading, and it is only an inference from those timestamps, is that this points to a routine, possibly automated, process rather than one-off thefts. The timestamps don't show who made the transfers.

The cases also show how wide the exposure can be. Case 1's holder said they used extension version 3.0.5. Case 3's holder said they used the Fearless iOS app, and the reviewed mobile apps don't contain the code. That is why the log says a listing doesn't prove how keys leaked, and why the Foundation warns that a phrase that was ever in the extension is compromised everywhere you use it. The log notes that several holders later used other wallet apps (Nova, SubWallet) with the same accounts. Those accounts were emptied anyway.

Case 2 is a warning for anyone with staked DOT. That holder had waited out the full unbonding period. The forum post says that right after the unstaking, a transfer_all sent everything to an unknown address. Locked funds can't be moved right away, by you or by anyone holding your key. When the lock ends, whoever moves first gets the coins.

If you used the Fearless Wallet extension: what to do now

This advice comes from the Foundation's notice and SlowMist's alert.

  1. Assume your recovery phrase is burned. If you used the extension at any time since February 2025, treat every account that was in it as compromised. That includes any phrase you imported into it from another wallet, or restored from a Fearless Google Drive backup.
  2. Create a brand-new recovery phrase in a different, well-maintained wallet. The Foundation suggests Nova Wallet, and says to keep it offline if you can. Don't import your old phrase into the new wallet and carry on using it. Moving to a new app only protects you if you also make a new keypair.
  3. Move everything, on every chain. Check the Polkadot relay chain, Asset Hub and any parachain, Ethereum or TON account that used the same phrase. If you can, sign the transfers from another wallet app instead of unlocking the Fearless extension again.
  4. Staked, pooled or voting funds: they can't move right away. Get help before you unbond. The Foundation points to PAPI Rescue (papirescue.now), built by the polkadot-api team. Never share your private keys with anyone, including the PAPI Rescue team. On Polkadot, nominators can unbond in as little as one or two days.
  5. Then remove the extension. Do it once your funds are safe. A password change or a reinstall doesn't fix a leaked key.
  6. Move funds from anywhere else you used the same phrase or key.

Warning signs that someone else holds your key, per the Foundation: your staking stopped or started unbonding, your reward destination changed, you left a nomination pool, a governance vote was removed, or small "test" transfers left your account. If you see any of these, move what you can at once.

If you lost funds: save your account address, the transaction hashes, dates and amounts. The Foundation suggests reporting to SEAL 911 and filing a police report, which you may need if your funds reached an exchange. Report the theft to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov, and file a report at blockint.ai (https://blockint.ai/c3?mode=file).

Ignore "recovery" offers. The Foundation says it plainly: no real helper will message you first offering to recover your funds, and no one needs your private keys. Polkadot does not have an X support account.

Why this one matters

This wasn't a fake wallet from a lookalike site. It was a known wallet, from the official store, with its source in public. The secret-stealing code sat in that public repository for 16 months under a function named after a token lookup. It switched itself on and off from a settings file that looked like feature flags. A user's warning, with timestamps, came about a year before the confirmation.

Two lessons hold for any browser wallet. First, an account belongs to its recovery phrase, not to the app. Once the phrase leaks, no update, reinstall or new app makes it safe again. Second, a browser extension holds the keys to everything in it, so keep only spending money in a hot wallet and keep larger amounts on a hardware wallet or a phrase that has never touched a browser.

Update, Oct 22, 2026: Our earlier C3 report (8e9f9247) says the victim and receiving addresses had not been published. The Polkadot Community Foundation's case log, linked from its October 21 security notice, now lists them: nine receiving addresses across eight cases, with 15,571.99 DOT plus 54,450.36 DED transferred out. They appear in the table above and in our follow-up report: https://blockint.ai/c3?report=8022b3f0-da33-4fba-815d-93a66791dad6

Sources

Official notices and alerts

Technical analysis and code

Domain

Losses and victim reports

Help