In Brief:
- Solana Mobile said a malicious third-party app named “SKR Claim” was submitted to the Solana dApp Store on Nov. 1 after an unauthorized party got into its dApp Publishing Portal.
- The app asked users to enter their seed phrases and was live in the dApp Spotlight for one hour before Solana Mobile removed it.
- The company said it patched the bug that let links reach apps that weren’t fully published, and it’s removing the app from devices where it was installed.
A phishing app that asked users for their seed phrases sat in the Solana dApp Store’s Spotlight for an hour on Nov. 1, Solana Mobile said. Someone had gained unauthorized access to the store’s publishing portal.
“Today a malicious third party app named ‘SKR Claim’ was submitted to the Solana dApp Store,” the company said in a post on X from its Seeker account. “The App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal. The app requested entry of user seed phrases.”
Today a malicious third party app named “SKR Claim” was submitted to the Solana dApp Store. The App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal. The app requested entry of user seed phrases.
The app was live on the dApp
“The app was live on the dApp Spotlight for one hour before being removed,” the company said.
How it got through
The intruder didn’t just submit an app. Solana Mobile said the attacker also changed the App Spotlight and Quests interfaces, the parts of the store that push apps and tasks to Seeker owners.
The company said it fixed a vulnerability that let links point to apps before they had been fully published in the store. That flaw let SKR Claim show up in the Spotlight before it had cleared publication.
Solana Mobile hasn’t said how the attacker got into the portal.
Seed Vault not involved
Seed Vault, the Seeker’s key storage, wasn’t breached. It keeps wallet keys apart from Android and from every installed app, and it needs the user to approve each signature with a password or biometrics. Private keys never leave it.
SKR Claim didn’t try to get around any of that. It simply asked people to type their seed phrase into the app by hand, so it never made a request to the vault at all.
Cleanup still underway
Solana Mobile said it’s removing the app from devices where it was installed. It hasn’t said that process is finished.
The company hasn’t released install numbers either. It also hasn’t said whether anyone entered a seed phrase or lost funds.
Solana Mobile said its team will never ask users for their seed phrase or for crypto, and won’t ask them to connect a wallet to other apps or sites to claim airdrops.
Removing the app doesn’t protect a phrase that has already been typed in. Anyone who entered one should treat that wallet as compromised, create a new wallet with a fresh recovery phrase and move any remaining assets right away.
Why ‘SKR Claim’ worked as bait
SKR is the native token of the Solana Mobile ecosystem and is used for governance and staking. Its first distribution went out in January 2026.
That airdrop told Seeker owners to claim through the phone’s built-in Seed Vault Wallet, not a separate app. The fake app borrowed the token’s name and got a top slot in the official store’s Spotlight for 60 minutes.
