3 hours ago
5
Key Takeaways
- The fake app asked for recovery phrases.
- It ran in App Spotlight for an hour.
- Deleting the app cannot protect a leaked phrase.
- No install, victim or loss figures yet.
Solana Mobile disclosed the incident in a November 1 post on X, saying a malicious third-party app named SKR Claim had been submitted to its dApp Store and asked users to enter their seed phrases.
What Solana Mobile Disclosed
According to the company, the intruder used its access to the dApp Publishing Portal to change App Spotlight and Quests, the curated parts of the store that steer users toward specific apps. SKR Claim stayed in Spotlight for about an hour before Solana Mobile pulled it from the store. Removal from phones where it had already been installed was still in progress when the company posted.
Solana Mobile also said it had patched a bug that allowed links to apps that were not fully published. It repeated that it never asks users for seed phras...
English (US)