Solana Mobile patches bug after malicious app appears in dApp Portal
Solana Mobile removed a malicious app called 'SKR Claim' from its dApp Portal after it spent one hour in the App Spotlight on November 1.
The malicious application, named 'SKR Claim,' was live for approximately one hour before the company yanked it, patched the underlying vulnerability, and began removing it from affected user devices. The breach occurred when someone gained unauthorized access to the dApp Publishing Portal and used that access to surface an unpublished app in a curated section of the store.
The bug allowed apps that had never been formally published to appear in spotlight features, which are the kind of prime placement users tend to trust. 'SKR Claim' was designed to collect seed phrases from users who believed they were claiming an airdrop.
Seed phrases are the master keys to crypto wallets. Handing one over to a fake app is the digital equivalent of giving a stranger your bank PIN, your passwords, and a spare house key, all at once.
Security Response
Solana Mobile confirmed that the breach did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems. The company is actively wiping the app from devices belonging to users who may have downloaded it during the one-hour window.
The underlying flaw was specific but consequential. Engineers identified that unpublished applications could, under certain conditions, be pulled into curated store sections like the App Spotlight. Engineers patched that vulnerability following the incident.
Solana Mobile is conducting a broader security review to catch similar gaps before they can be used again. The company also runs a bug bounty program focused specifically on the Seed Vault hardware wallet since August 2026.
User Advice
If a user downloaded 'SKR Claim' on November 1 and entered a seed phrase, that wallet should be considered compromised. Funds should be moved to a new wallet with a fresh seed phrase before any further action.
For users who saw the app but did not interact with it, or who did not download it at all, Solana Mobile says their devices and wallets are not at risk. The Seed Vault, which stores private keys in a hardware-isolated environment on Solana Mobile devices, was not touched.
The timing of the incident is notable, as the dApp Store crossed 1,000 apps in its catalog earlier in 2026, reflecting growth in the Solana mobile ecosystem.
Related
