Solana DApp Store Removes Malicious Seed-Phrase App
Solana Mobile removed the malicious “SKR Claim” app from the Solana DApp Store after it appeared in the App Spotlight for about an hour on November 1. The app asked users for their wallet seed phrases. Solana Mobile said an attacker gained unauthorized access to its publishing portal and altered the App Spotlight and Quests interfaces. The company has patched a vulnerability that allowed links to unreleased apps, is reviewing security controls and is removing the app from devices where it was installed. It said Solana Mobile devices, the Seed Vault hardware wallet and Solana’s on-chain systems were not compromised. Anyone who entered a seed phrase should consider that wallet compromised and move funds to a new wallet with a fresh phrase. Solana Mobile says it never asks for seed phrases or crypto assets, or requires a wallet connection to claim an airdrop. The incident highlights phishing and app-store review risks, but does not indicate a wider Solana network breach.
Neutral
The incident may create short-term caution around SOL as traders react to reports of a security lapse in Solana Mobile’s app distribution and review process. However, Solana Mobile said the issue was limited to its publishing portal, and that its devices, Seed Vault and Solana’s on-chain systems were not compromised. There is no reported disruption to the network or evidence of a broader breach, so the news does not directly change SOL’s utility or supply. Any price pressure is therefore more likely to reflect temporary concerns about security and user confidence than a fundamental change in the Solana market. In the longer term, the effect on SOL will depend on the effectiveness of the company’s fixes and review controls, as well as whether users report losses or further incidents. Based on the available information, a neutral impact on SOL is the most appropriate assessment.