Solana Mobile Says Fake 'SKR Claim' App Reached Store Spotlight

Solana Mobile said on Nov. 1 that a malicious app called “$SKR Claim,” which asked users to enter their wallet seed phrases, appeared in its dApp Store Spotlight for one hour following unauthorized access to its publishing portal.

In its incident disclosure, the company said the App Spotlight and Quests interfaces had been changed following that access. The app has been removed from the store, and removal from devices where it was installed was underway, Solana Mobile said.

The company also said it patched a bug that allowed links to apps that were not fully published. Its disclosure did not give installation or completed-removal counts, report whether any funds had been stolen, or explain how the unauthorized party gained access to the portal.

The risk extends beyond installing an unwanted app: a seed phrase is a wallet’s recovery key. Anyone who obtains it can take control of the wallet’s funds, as Solana Mobile’s own security guidance explains.

The dApp Store distributes apps for Solana Mobile devices. Under the company’s documented publishing process, submitted apps enter a review queue and go live once approved. The incident exposed a linking flaw: the company said its bug allowed links to apps that had not completed publication. It did not provide a technical account of how that flaw and the portal access were used together.

$SKR is used for governance and staking in Solana Mobile’s ecosystem. Its original airdrop instructions directed Seeker phone users to claim through the built-in Seed Vault Wallet, a process The Defiant covered at launch.

“The Solana Mobile team will never ask you for your seed phrase, for crypto, or to connect your wallet to other apps/sites to claim airdrops,” the company said.