Solana Mobile Removes Fake 'SKR Claim' App After Store Spotlight Breach
Solana Mobile removed a malicious app called 'SKR Claim' from its dApp Store after it appeared in the App Spotlight for about an hour on November 1. The app was designed to collect users' seed phrases, and the company has patched the flaw that let an unpublished app reach curated placement.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened on November 1
A malicious app called 'SKR Claim' was live in the App Spotlight of Solana Mobile's dApp Store for roughly one hour on November 1 before the company removed it. Solana Mobile said the app was surfaced after an attacker gained unauthorized access to the dApp Publishing Portal and used it to place an unpublished application in a curated store section.
The app was built to collect seed phrases from users who believed they were claiming an airdrop. A seed phrase grants full control of the wallet it generates, so anyone who entered one into the app would have exposed that wallet's funds. Solana Mobile said its team never asks users for seed phrases or wallet connections as part of any airdrop process.
The Underlying Flaw
According to Solana Mobile's engineers, the store's publishing pipeline and its curation layer were not fully aligned. Under certain conditions, apps that had never been formally published could be pulled into spotlight features, which are placements users tend to treat as vetted. The company has patched that gap and is running a broader security review to find similar weaknesses.
The two reports covering the incident differ on the mechanism. The Defiant describes the company as saying the bug allowed links to apps that were not fully published to surface, while Crypto Briefing describes it as a bug that let unpublished apps be pulled into curated sections. Both accounts agree on the core fault, an unpublished app reaching a curated slot, but the sources do not describe the exploit path identically, and neither has been independently verified against the company's technical disclosure.
Scope of Impact
Solana Mobile said the incident did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems. The company is removing the app from devices that may have installed it during the window. The reports do not give a count of affected users or of wallets drained, and the company has not published one in the material available.
For users who entered a seed phrase into 'SKR Claim' on November 1, the practical guidance is to treat that wallet as compromised and move funds to a new wallet with a fresh seed phrase. Users who saw the app but did not interact with it, or who never downloaded it, are not at risk according to the company.
Context and Open Questions
The dApp Store has grown past 1,000 apps, and the incident lands in a period of expanding catalog and distribution. Solana Mobile has also run a bug bounty program since August focused on the Seed Vault. The reports do not establish whether this flaw fell inside that program's scope or whether a researcher reported it before the attacker exploited it. Those questions remain unanswered pending further company disclosure.
Why It Matters
For Traders
Wallets that entered a seed phrase into the fake app should be treated as compromised, so any holdings on those wallets face near-term drain risk.
For Investors
Store-level security failures on a platform's distribution layer can dent trust in its curation, a factor to weigh alongside ecosystem growth.
For Builders
Publishing and curation pipelines must enforce the same publication state, so unpublished artifacts cannot reach featured placements.
This article is for information only and is not financial advice. Read the full disclaimer.
