Fake Airdrop App Targets Solana Mobile Wallets
A malicious app briefly surfaced in the dApp Store tried to steal wallet seed phrases, though Solana Mobile says its hardware wallet stayed secure.
Updated on Nov. 1, 2026 in Cybersecurity
Live Poll
Do you trust app stores to keep scam apps away from your crypto wallet?
A malicious app named 'SKR Claim' appeared in Solana Mobile's dApp Store App Spotlight for about one hour before being removed. The app was designed to collect seed phrases from users who believed they were claiming an airdrop. This is a live incident, not an announced or research-stage development.
Why it matters
The breach exploited a gap between the dApp Store's publishing pipeline and its curation layer, allowing an unpublished app to be surfaced in a curated section. It shows how app-store curation can become an attack surface for crypto wallet theft even when the hardware wallet itself is not compromised.
The attacker gained unauthorized access to the dApp Publishing Portal and used it to surface an unpublished app in the App Spotlight section, which was live for approximately one hour. Solana Mobile says the breach did not compromise device security, the Seed Vault hardware wallet, or any on-chain systems, but it has not said how many users downloaded the app during that window.
The players
Solana Mobile
Mobile hardware and software company building Solana-native phones, its Seed Vault hardware wallet, and the dApp Store app marketplace.
The details
The dApp Store is an app marketplace for Solana, a blockchain network, on Solana Mobile's phones. The attacker used unauthorized access to the publishing portal, where developers submit apps, to push an app that had not been approved into a curated showcase. The 'SKR Claim' app was built to trick users into entering their seed phrases, the master recovery words that control a crypto wallet, by posing as an airdrop claim. Solana Mobile says it never asks users for seed phrases as part of any airdrop.
Timeline
November 1, 2026: The malicious 'SKR Claim' app appeared in the App Spotlight and was removed.
August 2026: Solana Mobile began running a bug bounty program for Seed Vault.
Earlier in 2026: The dApp Store crossed 1,000 apps in its catalog.
The Tech Race
The incident shows that as mobile crypto wallets compete on hardware security, the app distribution layer becomes the more exposed attack surface. Solana Mobile's bug bounty program for Seed Vault, running since August 2026, is the parallel effort focused on the hardware side of that same problem.
Users of Solana Mobile phones and the dApp Store should never enter a seed phrase to claim an airdrop, since the company says it never asks for one. Anyone who may have installed 'SKR Claim' is being asked to have it removed from their device.
The takeaway
Treat any request for a seed phrase as a red flag, regardless of how the app was surfaced. Watch for the findings of Solana Mobile's broader security review of its publishing-to-curation pipeline.
What happens next
Solana Mobile is removing the app from devices of users who may have downloaded it during the window and is conducting a broader security review to catch similar gaps.
Further reading
For more on how attackers target crypto wallets, see our Cybersecurity coverage.
Live Poll
Do you trust app stores to keep scam apps away from your crypto wallet?
