A fake airdrop app called ‘SKR Claim’ spent one hour in the App Spotlight before Solana Mobile pulled it and pushed a security fix.
Solana Mobile had a rough morning on November 1 when a malicious application briefly made it into the App Spotlight of its decentralized app store. The app, named ‘SKR Claim,’ was live for approximately one hour before the company yanked it, patched the underlying vulnerability, and began removing it from affected user devices.
The core issue: someone gained unauthorized access to the dApp Publishing Portal and used that access to surface an unpublished app in a curated section of the store. The bug that made this possible allowed apps that had never been formally published to appear in spotlight features, which are the kind of prime placement users tend to trust.
What the malicious app actually did
‘SKR Claim’ was designed to collect seed phrases from users who believed they were claiming an airdrop. Seed phrases are the master keys to crypto wallets. Handing one over to a fake app is the digital equivalent of giving a stranger your bank PIN, your passwords, and a spare house key, all at once.
Solana Mobile was direct about the company’s own practices after the incident: its team never asks users for seed phrases or wallet connections as part of any airdrop process.
The company confirmed that the breach did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems. The damage window was narrow, roughly sixty minutes, but the company is still actively wiping the app from devices belonging to users who may have downloaded it during that window.
How the vulnerability worked
The underlying flaw was specific but consequential. Solana Mobile’s engineers identified that unpublished applications could, under certain conditions, be pulled into curated store sections like the App Spotlight. The dApp Store is supposed to surface vetted, published apps. A gap between the publishing pipeline and the curation layer created the opening that the attacker exploited.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
We respect your privacy. Unsubscribe anytime.
Engineers patched that vulnerability following the incident. Solana Mobile also confirmed it is conducting a broader security review to catch similar gaps before they can be used again.
The timing is notable. Earlier in 2026, the dApp Store crossed 1,000 apps in its catalog, a milestone that reflects genuine growth in the Solana mobile ecosystem.
Solana Mobile has been running a bug bounty program since August 2026, focused specifically on the Seed Vault hardware wallet. It is not yet clear whether this particular vulnerability fell within the scope of that program, or whether a security researcher flagged it before the attacker found it.
What users and the broader ecosystem should take from this
The immediate practical advice is straightforward. If a user downloaded ‘SKR Claim’ on November 1 and entered a seed phrase, that wallet should be considered compromised. Funds should be moved to a new wallet with a fresh seed phrase before any further action.
For users who saw the app but did not interact with it, or who did not download it at all, Solana Mobile says their devices and wallets are not at risk. The Seed Vault, which stores private keys in a hardware-isolated environment on Solana Mobile devices, was not touched.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.
More in Finance
Sweeper bots burn $4,800 in Bitcoin fees chasing $12.671 hours
Binance sees nearly $3.8 billion withdrawn in 10 hours after reopening3 hours
Crypto liquidations hit $12.5 billion in October 2026 as longs take the beating3 hours
Talis Protocol pauses listings after NFT exploit nets attacker about $3,1003 hours
Obol World sends 80% of revenue to buybacks and burns, launches API for bots3 hours
Elon Musk warns AI agents could become crypto’s next big security threat6 hours
