Key Takeaways
- A fraudulent SKR Claim app appeared in Solana Mobile’s dApp Store Spotlight on Nov. 1 following unauthorized access to its publishing portal.
- The app remained available for approximately one hour before Solana Mobile removed it and addressed a vulnerability involving unpublished applications.
- Users who entered wallet seed phrases into the fake app have been urged to move their assets to a new wallet immediately.
Solana Mobile faced a security incident on Nov. 1 after an unauthorized application posing as an SKR token claim tool appeared in the Solana dApp Store Spotlight.
The fraudulent listing, named SKR Claim, remained visible for approximately one hour, potentially exposing users to a wallet-draining scam.
Solana Mobile removed the application, patched a publishing vulnerability, and began taking steps to remove the unauthorized software from affected devices.
The incident raises concerns about how users verify cryptocurrency applications, particularly when a fraudulent listing appears inside an official app marketplace.
How Did a Fake SKR Claim App Enter Solana’s dApp Store?
According to Solana Mobile’s account of the incident, an unauthorized party accessed its app publishing portal and exploited a bug, allowing an unpublished application to appear in the store.
The fake SKR Claim application subsequently appeared in the Spotlight section, where users would ordinarily expect to find featured applications.
Its presence there could have made the listing appear more credible than a suspicious link distributed through social media.
The application was removed after roughly an hour, and Solana Mobile said it had patched the underlying publishing flaw.
The company also initiated the removal of the unauthorized application from devices on which it had been installed. However, the short exposure window does not establish how many people downloaded the app, whether anyone submitted a seed phrase, or whether cryptocurrency was stolen.
Why the SKR Airdrop Became an Attractive Phishing Target
The app’s name exploited an existing feature of Solana Mobile’s ecosystem.
SKR is the token associated with Solana Mobile’s Seeker platform, used for staking and governance. Earlier in 2026, Solana Mobile introduced an SKR airdrop claiming process through its built-in Seed Vault Wallet.
That legitimate distribution gave scammers a recognizable theme to imitate.
The fake app requested seed phrases, the recovery words that provide access to a cryptocurrency wallet. Anyone obtaining those words can potentially restore the wallet elsewhere and transfer its assets.
Solana Mobile emphasized that its team never asks users to disclose seed phrases, send cryptocurrency, or connect wallets to external applications to claim airdrops.
The company also said the incident did not compromise the Seed Vault hardware wallet, Solana Mobile device security, or blockchain systems. The identified failure concerned app distribution rather than the underlying network.
What Should Solana Mobile Users Do After the Breach?
Users who installed SKR Claim should stop interacting with it and follow Solana Mobile’s official removal guidance.
Anyone who entered a seed phrase should consider the corresponding wallet compromised, create a new wallet with a fresh recovery phrase, and transfer remaining assets immediately.
Simply uninstalling the malicious app cannot make an exposed seed phrase secure again. Solana Mobile has not disclosed the number of installations, confirmed financial losses, or the attacker’s identity.
The incident also comes as its application marketplace expands. On Oct. 22, the company announced that the Solana dApp Store had surpassed 1,500 applications.
That growth increases the importance of preventing unauthorized applications from reaching featured sections.
Although Solana Mobile closed the identified publishing loophole, the breach exposed a broader weakness in cryptocurrency app discovery: a familiar token name and prominent marketplace placement can make a phishing attempt appear legitimate.
For users, the most important safeguard remains unchanged. No legitimate token claim requires revealing a wallet’s seed phrase.
Top Trending Crypto Articles
The views, thoughts, and opinions expressed in the article belong solely to the author, and not necessarily to CCN, its management, employees, or affiliates. This content is for informational purposes only and should not be considered professional advice.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
