Solana Mobile removed a malicious app called “SKR Claim” from the App Spotlight section of its decentralized app store after it was live for about one hour on November 1, then patched the vulnerability that allowed it to appear and began removing it from affected user devices.
The app was designed to collect seed phrases from users who believed they were claiming an airdrop. Seed phrases are the master keys to crypto wallets.
How the app surfaced
Solana Mobile said someone gained unauthorized access to the dApp Publishing Portal and used it to surface an unpublished app in a curated section of the store. The bug allowed apps that had never been formally published to appear in spotlight features. A gap between the publishing pipeline and the curation layer created the opening, the company said.
Engineers patched the vulnerability after the incident. Solana Mobile also said it is conducting a broader security review to catch similar gaps.
What was and was not affected
Solana Mobile confirmed the breach did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems. The Seed Vault stores private keys in a hardware-isolated environment on Solana Mobile devices and was not touched.
The company said its team never asks users for seed phrases or wallet connections as part of any airdrop process.
What users should do
Users who downloaded “SKR Claim” on November 1 and entered a seed phrase should consider that wallet compromised. Funds should be moved to a new wallet with a fresh seed phrase before any further action.
Users who saw the app but did not interact with it, or who did not download it, are not at risk, according to Solana Mobile.
Context
Earlier in 2026, the dApp Store crossed 1,000 apps in its catalog. Solana Mobile has run a bug bounty program since August 2026 focused specifically on the Seed Vault hardware wallet. It is not yet clear whether this vulnerability fell within that program’s scope or whether a security researcher flagged it before the attacker found it.
