Solana Mobile: Its Own App Store Featured a Fake 'SKR Claim' App That Asked for Seed Phrases

For about an hour on Sunday 1 November 2026, the app store built into the Seeker, a smartphone made for crypto by Solana Mobile, promoted a new app in its shop window. It was called "SKR Claim". It carried the name of the token Solana Mobile hands out to its own customers, and it sat in the space the company uses to recommend apps. It asked for one thing: the owner's seed phrase, the list of words that unlocks a crypto wallet.

The app was a theft tool. At 18:34 UTC that day Solana Mobile said on X that "a malicious third party app" had been submitted to the Solana dApp Store, and that the store's App Spotlight and Quests screens "were updated following unauthorized access to the dApp Publishing Portal", the website app makers use to submit and manage their apps. The fake app, the company said, "was live on the dApp Spotlight for one hour" before it was taken down, and it was "currently being removed from devices where it was installed."

The statement left out the numbers that matter most. Solana Mobile did not say how many phones installed the app, how many owners typed in their words, or whether any money was taken. It did not say how the intruder got into the publishing portal or whose account was used. By 2 November that post was still the company's only statement on its X account. The Defiant, which covered the incident alongside PANews and BlockBeats, noted the same gaps. No loss figure has been published by the company, by a blockchain analytics firm or by anyone saying they were a victim.

The master key

A crypto wallet does not work like a bank account. A seed phrase, usually 12 or 24 ordinary English words in a fixed order, is the master key to it. Whoever has the words controls the wallet, from any device, anywhere in the world. There is no bank to call, no password reset and no way to reverse a transfer once it is recorded on the blockchain, the shared public ledger that logs every transaction. In stock-market terms, handing over a seed phrase is not like giving someone the login to a brokerage account. It is like signing the shares over to them, with no broker able to claw them back.

That is why no genuine app, exchange or wallet maker ever asks a customer to type the words in. The phrase is needed only to restore a wallet onto a new device, inside the wallet app itself. Any other screen that asks for it is trying to steal it. Solana Mobile's own statement ended on exactly that point: "The Solana Mobile team will never ask you for your seed phrase, for crypto, or to connect your wallet to other apps/sites to claim airdrops."

The Seeker was designed so that owners never need to expose the words at all. It ships with Seed Vault, a wallet that keeps the keys inside protected hardware in the phone, much as a bank card keeps its secret on the chip. An app that persuades the owner to type the words into a box simply walks around that protection.

Why the name worked

SKR is Solana Mobile's own token, a digital asset that runs on the Solana blockchain. The company launched it on 20 January 2026 with an airdrop, a free handout of tokens. Solana Mobile said nearly 2 billion SKR would go to more than 100,000 Seeker users and 188 app developers; The Block reported a total supply of 10 billion. Holders can stake it, which means locking it up to earn more tokens, roughly as a shareholder might reinvest dividends. Staked SKR is delegated to "Guardians", which Solana Mobile says verify that phones are genuine and coordinate reviews of apps.

Over the summer Solana Mobile ran Seeker Summer, a campaign that paid out SKR in rounds to owners who completed quests, small tasks inside featured apps: 25 million SKR in the first round and 27 million in the second, according to Solana Compass. The real claim button sits inside the Seed Vault Wallet, under its Activity Tracking tab, and never asks for the words. An app called "SKR Claim", promoted by the store itself, could easily pass for the next round.

The trust problem

App stores sell trust as much as software. Apple's App Store and Google Play review apps before they appear, and when a store promotes an app on its front page, customers reasonably read it as an endorsement. The Solana dApp Store (a dApp is an app built to work with crypto wallets) comes installed on every Seeker and works on the same principle. Submitted apps normally pass through a review queue before they go live, The Defiant reported.

The Spotlight is the store's shop window. A scam app placed there is not like a fake advert on a website. It is closer to an outsider breaking into a broker's systems and slipping a forged tip into the morning note the broker sends its clients. Owners used to trusting the store, and to claiming SKR rewards, had little reason to doubt it.

Solana Mobile's explanation points to two failures. First, someone got into the publishing portal without permission. Second, a bug "allowed linking to apps that were not fully published", which the company says it has found and patched. Put simply, the Spotlight and Quests screens could point owners to an app that had not finished the store's process, and the intruder used that to put an unchecked app in the most prominent places on the phone. The company has not said how the portal was accessed.

A phone sold on safety

Solana Mobile is a subsidiary of Solana Labs, the company that created the Solana blockchain. Its first phone, the Saga, went on sale in 2023 at $1,000, sold poorly and had its price cut to $599 within months. The second, the Seeker, runs on Android and began shipping on 4 August 2025 to buyers in more than 50 countries after more than 150,000 pre-orders, the company said at the time.

The pitch for both phones has been security: a wallet locked into hardware and a store curated for crypto users. The SKR Claim episode showed that the weak point was not the chip but the screen in front of it, and the trusted shelf the fake app was placed on. Three days earlier, on 29 October, a hacked website tool at Polymarket had shown the same pattern: an official, trusted front end turned against the people who relied on it.