In Brief:
- An unauthorized party got into Solana Mobile’s dApp Publishing Portal, and on Nov. 1 a malicious third-party app called “SKR Claim” was submitted to the Solana dApp Store, the company said.
- SKR Claim prompted users to type in their seed phrases. It ran in the dApp Spotlight for one hour before Solana Mobile pulled it.
- Solana Mobile said it fixed the bug that allowed links to reach apps that weren’t fully published, and it is removing the app from devices that installed it.
According to Solana Mobile, a phishing app asking for seed phrases held a spot in the Solana dApp Store’s Spotlight for an hour on Nov. 1. The store’s publishing portal had been accessed by someone without authorization.
The company posted about it on X through its Seeker account: “Today a malicious third party app named ‘SKR Claim’ was submitted to the Solana dApp Store. The App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal. The app requested entry of user seed phrases.”
Today a malicious third party app named “SKR Claim” was submitted to the Solana dApp Store. The App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal. The app requested entry of user seed phrases.
The app was live on the dAppSeeker | Solana MobileView on X ↗
The company added: “The app was live on the dApp Spotlight for one hour before being removed.”
How the app got in
Submitting an app was only part of what the intruder did. Solana Mobile said the attacker also edited the App Spotlight and Quests interfaces, which are the sections of the store that promote apps and tasks to Seeker owners.
Solana Mobile said it has fixed a vulnerability that allowed links to point to apps that hadn’t finished being published in the store. Because of that flaw, SKR Claim appeared in the Spotlight before it had cleared publication.
The company hasn’t explained how the attacker got access to the portal.
Seed Vault wasn’t touched
Seed Vault, the Seeker’s key storage, was not breached. It holds wallet keys separately from Android and from every installed app, and each signature needs the user’s approval by password or biometrics. Private keys never leave it.
SKR Claim made no attempt to get past those protections. It asked people to enter their seed phrase into the app manually, so it never sent the vault a request.
Cleanup is ongoing
Solana Mobile said it is removing the app from the devices that installed it. It hasn’t confirmed that the removal is complete.
No install figures have been published. The company also hasn’t said whether any user entered a seed phrase or lost funds.
According to Solana Mobile, its team will never ask users for a seed phrase or for crypto. It also won’t ask them to connect a wallet to other apps or sites to claim airdrops.
Taking the app off a phone does nothing for a phrase that has already been entered. Anyone who typed one in should treat that wallet as compromised, set up a new wallet with a fresh recovery phrase and move whatever assets remain immediately.
Why the ‘SKR Claim’ name worked
SKR is the native token of the Solana Mobile ecosystem, used for governance and staking. Its first distribution took place in January 2026.
For that airdrop, Seeker owners were told to claim through the phone’s built-in Seed Vault Wallet instead of a separate app. The fake app used the token’s name and held a top spot in the official store’s Spotlight for 60 minutes.