Solana Mobile Patches Flaw After Malicious App Surfaces
A fake airdrop app designed to steal seed phrases was briefly featured in the dApp Store's App Spotlight before being removed.
Updated on Nov. 1, 2026 in Cybersecurity
Live Poll
Do you trust app stores to keep scam apps away from your crypto wallet?
A malicious app named 'SKR Claim' appeared in Solana Mobile's dApp Store App Spotlight for approximately one hour. The app was designed to collect seed phrases from users who believed they were claiming an airdrop.
Why it matters
The incident exposed a gap between the dApp Store's publishing pipeline and its curation layer that allowed unpublished apps to be surfaced to users. Because seed phrases grant full control of crypto wallets, the attempt posed a direct financial risk to anyone who installed the app.
The app was live for approximately one hour in a curated section of a store carrying more than 1,000 apps. Engineers have since patched the vulnerability, but the number of affected devices has not been disclosed.
The players
Solana Mobile
Solana Mobile is the company that builds mobile hardware and software for the Solana blockchain ecosystem, including the dApp Store where the incident occurred.
The details
An attacker gained unauthorized access to the dApp Publishing Portal and used it to surface an unpublished application in the App Spotlight. Solana Mobile is removing the app from devices belonging to users who may have downloaded it during the window and is running a broader security review to catch similar gaps.
Timeline
- November 1, 2026: The malicious 'SKR Claim' app appeared in the App Spotlight and was removed.
- August 2026: Solana Mobile began running a bug bounty program for the Seed Vault.
- Earlier in 2026: The dApp Store crossed 1,000 apps in its catalog.
The Tech Race
The breach did not compromise the Seed Vault hardware wallet itself, which shows the protection held at the key level while the app-distribution layer was the weak point. The episode highlights that securing mobile crypto ecosystems requires guarding both hardware and the storefronts that deliver software to it.
Users who installed 'SKR Claim' should remove it, since the app was built to harvest seed phrases. Anyone who entered a seed phrase into any airdrop claim flow should treat that wallet as compromised and move funds to a new wallet.
The takeaway
Legitimate airdrops never ask for seed phrases or wallet connections, so any request for them should be treated as a red flag. Verifying app sources before installing remains the most reliable defense against this kind of fake-claim scam.
Further reading
Explore more Cybersecurity coverage to see how app-store and wallet threats are evolving.
Source note: This article includes information reported by Crypto Briefing.
Live Poll
Do you trust app stores to keep scam apps away from your crypto wallet?
