A fake airdrop app called 'SKR Claim' spent one hour in the App Spotlight before Solana Mobile pulled it and pushed a security fix.
Solana Mobile had a rough morning on November 1 when a malicious application briefly made it into the App Spotlight of its decentralized app store. The app, named ‘SKR Claim,’ was live for approximately one hour before the company yanked it, patched the underlying vulnerability, and began removing it from affected user devices.
The core issue: someone gained unauthorized access to the dApp Publishing Portal and used that access to surface an unpublished app in a curated section of the store. The bug that made this possible allowed apps that had never been formally published to appear in spotlight features, which are the kind of prime placement users tend to trust.
What the malicious app actually did
‘SKR Claim’ was designed to collect seed phrases from users who believed they were claiming an airdrop. Seed phrases are the master keys to crypto wallets. Handing one over to a fake app is the digital equivalent of giving a stranger your bank PIN, your passwords, and a spare house key, all at once.
Solana Mobile was direct about the company’s own practices after the incident: its team never asks users for seed phrases or wallet connections as part of any airdrop process.
The company confirmed that the breach did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems. The damage window was narrow, roughly sixty minutes, but the company is still actively wiping the app from devices belonging to users who may have downloaded it during that window.
How the vulnerability worked
The underlying flaw was specific but consequential. Solana Mobile’s engineers identified that unpublished applications could, under certain conditions, be pulled into curated store sections like the App Spotlight. The dApp Store is supposed to surface vetted, published apps. A gap between the publishing pipeline and the curation layer created the opening that the attacker exploited.
Engineers patched that vulnerability following the incident. Solana Mobile also confirmed it is conducting a broader security review to catch similar gaps before they can be used again.
The timing is notable. Earlier in 2026, the dApp Store crossed 1,000 apps in its catalog, a milestone that reflects genuine growth in the Solana mobile ecosystem.
Solana Mobile has been running a bug bounty program since August 2026, focused specifically on the Seed Vault hardware wallet. It is not yet clear whether this particular vulnerability fell within the scope of that program, or whether a security researcher flagged it before the attacker found it.
What users and the broader ecosystem should take from this
The immediate practical advice is straightforward. If a user downloaded ‘SKR Claim’ on November 1 and entered a seed phrase, that wallet should be considered compromised. Funds should be moved to a new wallet with a fresh seed phrase before any further action.
For users who saw the app but did not interact with it, or who did not download it at all, Solana Mobile says their devices and wallets are not at risk. The Seed Vault, which stores private keys in a hardware-isolated environment on Solana Mobile devices, was not touched.
