Solana Mobile Removes Malicious SKR Claim App From Solana (SOL) Store After an Hour

SKR Claim Spent an Hour in Spotlight

Solana (SOL) Mobile removed a malicious third-party application named SKR Claim from its dApp Store in the early hours of November 2, Taiwan time, after the app spent roughly one hour in the store's App Spotlight recommendation section while asking users to enter their wallet seed phrase. The team laid out the sequence in an official statement: unauthorized access to the dApp Publishing Portal, the entry point developers use to submit applications, was followed by modifications to both the App Spotlight section and the Quests tasks interface. Whoever held that access used it to place the malicious dapp in front of the store's installed audience. The store is the application catalog for Solana's mobile devices, part of the broader Solana ecosystem, and its recommendation slots carry weight that a plain search result does not, because users read placement there as the store's own vetting. A seed phrase sits at the top of the credential hierarchy in self-custody: it restores the wallet and controls its funds, which is why any request to type it into an app or a website follows a familiar phishing pattern. The official account places the compromise at the publishing portal, an administrative surface, and describes no separate incident on the network itself. The notice addressed store security and user credentials only; it made no statement about the Solana price or any market effect.

A Patched Flaw and a Standing Rule

The response came in two parts, both stated in the same disclosure. The team said it examined the incident, identified and patched a vulnerability that had allowed applications to be linked before their publication was complete, and framed the fix as lowering the chance of a repeat. It also restated a standing rule: Solana (SOL) Mobile will not ask users for a seed phrase, for a payment in cryptocurrency, or for a wallet connection to another app or website in order to claim an airdrop. The guidance then draws a line between credential types. An app's presence in a recommendation section is not, by itself, a reason to hand over a recovery phrase; the phrase governs wallet recovery and asset control, a different class of secret from a login password or a routine wallet connection. Connecting a wallet exposes it to whatever a user approves, and approving actions whose contents cannot be inspected is the separate failure mode known as blind signing; a surrendered phrase removes the approval layer altogether. The statement is explicit about the consequence: once a phrase has been entered and may have leaked, removing the app or deleting it from a device does not recall the credential. Users are told to treat two questions separately: whether the malicious application is gone from the device, and whether the wallet's credentials are still safe. The store-side cleanup, in other words, fixes the distribution channel but leaves the exposure untouched.

What the Record Leaves Unresolved

The episode shows how far a curation layer reaches as a security boundary. An intruder who can edit App Spotlight inherits the store's endorsement, and one hour of placement is long enough to collect phrases from even a small share of visitors. The record splits responsibility cleanly: Solana (SOL) Mobile pulled the app, patched the portal flaw and restated its rules, yet it has no mechanism to reach anyone who already typed a phrase into SKR Claim. For those users the corrective step is a new wallet and fresh keys, not a store update; our comparison of the 11 best Solana wallets is a starting point for that move.