News linked to both this project and an event.
The Polkadot Community Foundation issued a security warning on the Polkadot Forum stating that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the browser extension for the third-party wallet Fearless Wallet contain malicious code, which may transmit users' private keys to attacker-controlled servers when unlocking the wallet. The relevant code was added on February 19, 2025, via a code commit titled “TON ecosystem”, and was triggered intermittently from February 2025 to October 10, 2026.
the L1 blockchain TAC team stated they have confirmed a security incident on the cross-chain layer resulted in approximately $2.8 million in assets being transferred, involving assets such as USDT, BLUM, and tsTON.TAC stated that if the attacker returns the relevant funds to the designated multi-signature address, the team will consider this incident a "white hat rescue" and will not take legal action against the operator of the involved ETH/BSC, ZEC, and TON addresses.As a reward, the attacker can receive an approximately 10% bounty, equivalent to about 13 ETH and 300 ZEC.
TAC stated that its cross-chain layer on the TON side was exploited by external attackers, resulting in approximately $2.8 million in losses involving USDT, BLUM, and tsTON. TAC confirmed that the TAC token, TON, and all ERC-20 tokens bridged from Ethereum remain unaffected. The bridge has been temporarily suspended, and the team is conducting forensic analysis and implementing fixes. Additionally, the team plans to legally structure a sale of the foundation’s TAC token treasury reserves to restore bridge liquidity and compensate affected users. A post-mortem report and further details will be released within the next 48 hours.