On November 1, 2026, Solana Mobile patched a dApp Store vulnerability after a fake app named 'SKR Claim' breached the publishing portal and appeared in the App Spotlight for about an hour. Designed to steal wallet seed phrases, the malicious app was yanked while Solana Mobile initiated remote wipes on affected devices. Solana Mobile confirmed that device security and its hardware-isolated Seed Vault remained uncompromised, advising any compromised users to migrate funds immediately.
Incident details and response
- ▪A malicious fake airdrop app named 'SKR Claim' appeared in the App Spotlight section of the Solana Mobile dApp store for approximately one hour on November 1, 2026
- ▪An attacker obtained unauthorized access to the Solana Mobile dApp Publishing Portal to surface the unpublished 'SKR Claim' app
- ▪Solana Mobile patched a bug that allowed applications that had never been formally published to be pulled into curated sections of Solana Mobile's dApp Store
- ▪Solana Mobile pulled the malicious 'SKR Claim' application from its store and began remotely removing it from affected user devices on November 1, 2026
App functionality and security advice
- ▪Solana Mobile's malicious 'SKR Claim' app was designed to collect wallet seed phrases from users under the guise of an airdrop claim
- ▪Solana Mobile stated that its team never requests seed phrases or wallet connections as part of any official airdrop process
- ▪Solana Mobile advised users who downloaded the fake airdrop app 'SKR Claim' on November 1, 2026 and submitted a seed phrase to immediately transfer funds to a new wallet with a fresh seed phrase
System integrity and follow-up review
- ▪Solana Mobile confirmed that the November 1, 2026 'SKR Claim' breach did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems
- ▪Solana Mobile stated that devices and wallets belonging to users who did not interact with or download the fake airdrop app 'SKR Claim' remain safe and uncompromised
- ▪Solana Mobile launched a comprehensive security review following the November 1, 2026 'SKR Claim' breach to identify potential additional gaps in its publishing and curation pipeline
Story comments
Loading comments…