Fake SKR Claim App Asking for Seed Phrases Reached Solana dApp Store

A malicious SKR Claim app that asked users to type in their seed phrases was shown in the Solana dApp Store’s App Spotlight for about an hour on Sunday, Solana Mobile said. If you use a Solana Mobile phone and entered your seed phrase into an app called “SKR Claim”, treat that wallet as compromised. Solana Mobile says its team “will never ask you for your seed phrase, for crypto, or to connect your wallet to other apps/sites to claim airdrops.”

In a post on X at 18:34 UTC on 1 November, Solana Mobile said the third-party app was submitted to the store, and that “the App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal.” The app “was live on the dApp Spotlight for one hour before being removed from the dApp Store”, and is now being removed from phones where it was installed.

What to do if you saw the SKR Claim app

Solana Mobile is pulling the app from devices, but it is worth checking yourself:

• Look for the app. If “SKR Claim” is still on your phone, uninstall it.
• If you typed in your seed phrase, assume the wallet is no longer yours alone. As general practice, TSN’s advice is to create a new wallet with a new seed phrase, on a device you trust, and move any remaining funds to it straight away. Then stop using the old wallet.
• If you opened the app but entered nothing, Solana Mobile has not said there is any further risk. Uninstall it anyway.
• Ignore any “claim” that asks for your recovery words, wherever it appears. That includes an app store’s own featured slots.

A seed phrase gives full control of a wallet to whoever holds it. TSN’s guide to seed phrases explains why it should never be typed into an app or website.

What Solana Mobile says happened

Solana Mobile said that, after a review, “our team identified and patched a bug that allowed linking to apps that were not fully published to mitigate this from happening again.”

The company has not said how many people installed the app, whether anyone entered a seed phrase, or whether any funds were taken. It has also not said who gained access to the Publishing Portal or how. TSN found no separate notice on Solana Mobile’s blog or developer docs by about 20:00 GMT.

Solana Mobile’s developer documentation describes the normal route into the store: developers submit apps through the dApp Publishing Portal, and new apps “automatically enter the app review queue and will go live immediately under an appropriate category once approved.” Review results typically arrive within three to four business days.

Why a featured slot makes the SKR Claim app more dangerous

Most seed phrase scams have to persuade people to visit a fake site or install something from outside an official store. This one appeared in the Spotlight, the store’s own promoted area, and in the Quests section, which users have every reason to trust. That placement does a scammer’s hardest work for them.

The bug Solana Mobile describes matters here. Its docs say apps go live only once they are approved. Solana Mobile’s account suggests the Spotlight could link to an app that had not finished publishing, so the store’s front page could point at something that had not been through that process. Solana Mobile says that gap is now patched; it has not said whether the app had passed review.

Two things are still missing. The first is the scale: an hour in a featured slot may mean few installs or many, and Solana Mobile has given no figure. The second is how someone got into the Publishing Portal, which is the part that would tell other store operators what to fix. Until Solana Mobile says more, the safe assumption for anyone who typed in a seed phrase is that the wallet is exposed.

The pattern is familiar. Attackers keep finding ways to put themselves inside trusted channels, from a tampered support-chat script that swapped deposit addresses to weak wallet seeds behind the Qubic drain of 1,404 wallets. TSN tracks these incidents on its crypto hacks hub.

What comes next

Solana Mobile says removal of the app from devices is still under way. TSN will update this post if the company gives install numbers, any losses, or more on how the portal was accessed.

Sources

• Solana Mobile on X: statement on the “SKR Claim” app, 1 November 2026, 18:34 UTC
• Solana Mobile docs: Submit a New App (dApp Publishing Portal and review process)
• The Defiant: Solana Mobile Says Fake ‘SKR Claim’ App Reached Store Spotlight

Related stories

• What Is a Seed Phrase? (And How to Keep It Safe)
• Qubic Halts Its Network After Attacker Drains 1,404 Wallets Through Weak Seeds
• SlowMist Urges Sites to Pull Tampered Udesk Script Swapping Addresses