Fake Crypto Airdrop App Hit Official Store, Seed Phrases at Risk

Key Takeaways

• The fake app asked for recovery phrases.
• It ran in App Spotlight for an hour.
• Deleting the app cannot protect a leaked phrase.
• No install, victim or loss figures yet.

Solana Mobile disclosed the incident in a November 1 post on X, saying a malicious third-party app named SKR Claim had been submitted to its dApp Store and asked users to enter their seed phrases.

What Solana Mobile Disclosed

According to the company, the intruder used its access to the dApp Publishing Portal to change App Spotlight and Quests, the curated parts of the store that steer users toward specific apps. SKR Claim stayed in Spotlight for about an hour before Solana Mobile pulled it from the store. Removal from phones where it had already been installed was still in progress when the company posted.

Solana Mobile also said it had patched a bug that allowed links to apps that were not fully published. It repeated that it never asks users for seed phrases or crypto assets, and never asks them to connect a wallet to claim an airdrop.

The attacker picked a name Seeker owners already knew. SKR is the native token of the Solana Mobile ecosystem, and the first SKR airdrop was claimed through the phone’s built-in wallet after it opened in January. Emmett Hollyer, Solana Mobile’s general manager, called that drop “the first step.” An app offering another claim, placed in the store’s own featured section, matched something users had already done once.

Today a malicious third party app named “SKR Claim” was submitted to the Solana dApp Store. The App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal. The app requested entry of user seed phrases.

The app was live on the dApp Spotlight for one hour before being removed from the dApp Store. It is currently being removed from devices where it was installed.

Following review, our team identified and patched a bug that allowed linking to apps that were not fully published to mitigate this from happening again.

The Solana Mobile team will never ask you for your seed phrase, for crypto, or to connect your wallet to other apps/sites to claim airdrops.

— Seeker | Solana Mobile (@solanamobile) November 1, 2026

How an Unfinished App Got a Featured Slot

Solana Mobile’s publishing guide sets out a fixed order: a developer submits an app, Solana Mobile reviews it, and the app goes live once approved. The bug the company described broke that order at the final step. Its wording, links to apps that were not fully published, indicates SKR Claim reached users through Spotlight before it had completed publication. The statement does not say how far the app had progressed through review.

Two separate failures had to coincide: an intruder inside the portal, and a linking flaw that let a featured tile point to an unpublished app. The patch fixes the second. The statement does not explain the first.

The store’s terms of service say featuring an app is not a recommendation or warranty. That disclaimer assumes Solana Mobile chose what to feature. In this case, an unauthorized party made the choice.

Why Seed Vault Didn’t Stop It

Seeker’s security design is built around keeping wallet keys out of reach. Seed Vault stores them separately from Android and every installed app. When a wallet needs a transaction signed, the user approves it with a password or biometrics, and the vault signs without exposing the private key.

SKR Claim never asked the vault for anything. It asked the person. A recovery phrase is the set of backup words that can rebuild a wallet on any device, so whoever receives it gets the same control as the owner without ever touching the phone’s secure storage.

Breaking into Seed Vault would be hard. Borrowing the store’s credibility took portal access and a linking bug. That is the side of Solana Mobile’s hardware-security strategy that hardware cannot cover: the vault keeps keys away from other software, but it cannot tell whether a featured app asking for a phrase is genuine. That judgment falls to the user, who in this case was looking at the store’s own featured section.

Nothing in the statement suggests Seed Vault itself was breached. The company has not said what SKR Claim did on devices beyond requesting recovery phrases.

How a 10 ETH Refund Bug Froze THORChain Trading on 10 Chains

What to Do Depends on What You Did

Removing the listing closed the store window, and uninstalling closes the app window. A phrase that has already been typed stays usable to whoever received it, whatever happens to the app afterwards.

Find your situation

Saw the listing

Nothing to undo. Viewing the Spotlight tile does not expose a wallet.

Installed, typed nothing

Uninstall it if it is still on the phone, and follow Solana Mobile’s official X account for findings on what the app did.

Approved a wallet prompt

Review the wallet’s transaction history and remove any token permissions you don’t recognize, using the wallet’s own tools.

Typed your recovery phrase

Treat that wallet as compromised and move to a new one immediately.

For anyone who typed their phrase, the fix is a genuinely new wallet: created on a trusted device, protected by a fresh recovery phrase, with remaining assets moved into it as soon as possible. Restoring the old phrase in a different wallet app does not help, because the attacker holds the same words. Changing the phone’s PIN or wallet password does not help either, since those protect the device rather than the phrase.

Check the old wallet for staked or otherwise locked balances too, because the phrase controls those as well. After moving funds, stop using the old address for anything that could send assets there later.

What Solana Mobile Still Hasn’t Said

The disclosure confirms the scam and one fix. It leaves four questions open:

1. How the intruder got into the publishing portal, and whether that access has been shut off separately from the bug fix.
2. How many devices installed SKR Claim before it was pulled.
3. Whether removal from those devices is complete, and how it was carried out.
4. Whether any recovery phrases were collected or any funds moved.