Solana Mobile: dApp Portal Flaw Patched After Fake App Appears

Solana Mobile removed SKR Claim, patched a flaw that let unpublished apps enter its App Spotlight, and began wiping the app after roughly one hour. Separately, Padre Terminal stole about $23,000 from 27 Solana wallets.

CryptoMEV Bot NewsroomNov 1, 20263 min read

Illustration of a blue hand on a document, next to a smartphone screen showing a large, watchful eye. — Image: Gibrán Aquino / Wikimedia Commons (CC BY-SA 4.0)

At a glance	Details
Who	Solana Mobile users and 27 Solana wallets
What	SKR Claim removed and publishing flaw patched
When	November 1, 2026
Where	Solana Mobile dApp Store
Key figure	Approximately $23,000 stolen from 27 wallets

Solana Mobile users who downloaded the fake SKR Claim app on November 1, 2026 may have exposed their wallet seed phrases. Solana Mobile said it removed the app, patched the publishing-portal vulnerability and began wiping it from affected devices after roughly one hour in the App Spotlight. A separate fake trading app stole approximately $23,000 from 27 Solana wallets.

How did SKR Claim reach the App Spotlight?

According to Crypto Briefing, someone gained unauthorized access to the dApp Publishing Portal and used it to surface an unpublished app in a curated section of Solana Mobile’s decentralized app store. The flaw allowed applications that had never been formally published to appear in spotlight features, creating a gap between the publishing pipeline and the curation layer.

SKR Claim was designed to collect seed phrases from users who believed they were claiming an airdrop. Solana Mobile’s stated policy was:

"its team never asks users for seed phrases or wallet connections as part of any airdrop process." — Solana Mobile

What was affected during the incident?

Solana Mobile confirmed that the breach did not compromise device security, the Seed Vault hardware wallet or any on-chain systems. The company described the exposure window as roughly sixty minutes and said it was still removing SKR Claim from devices belonging to users who might have downloaded it during that period.

The Seed Vault was described as storing private keys in a hardware-isolated environment on Solana Mobile devices. Users who saw the app but did not interact with it, and users who never downloaded it, were not considered at risk.

Earlier in 2026, the dApp Store crossed 1,000 apps in its catalog. Solana Mobile had also been running a bug bounty program since August 2026, focused specifically on the Seed Vault hardware wallet. It was not clear whether the publishing-portal vulnerability fell within that program’s scope or whether a security researcher had flagged it before the attacker exploited it.

How did the separate trading app drain wallets?

SC World, citing Bleeping Computer, reported that Padre Terminal had previously appeared on the Apple App Store. The application was identified as a cryptocurrency drainer responsible for stealing approximately $23,000 from 27 Solana wallets.

Padre Terminal masqueraded as a legitimate trading platform for meme coins on the Solana blockchain and drained digital assets after users imported their private keys into its interface. The official Padre service operated exclusively on the web, while the fraudulent mobile version deceived users before its removal from the Apple App Store.

Blockchain investigator Iris traced the stolen funds to a specific Solana address and said the attacker converted the assets into SOL to prevent potential recovery. Researchers also identified at least four other suspicious applications on the platform, including apps impersonating GMGN AI and Axiom. SC World said these applications used deceptive descriptions to appear legitimate while hiding malicious functionality.

What should wallet users and bot operators check?

The practical distinction is between an app-level compromise and an on-chain system compromise. Solana Mobile said the SKR Claim incident did not affect on-chain systems, while the reported Padre Terminal losses followed users entering private keys into a fraudulent interface.

For readers using the site’s copy-trading guide or advanced MEV bot overview, the relevant risk boundary is software provenance: the reported compromises began at the app and wallet-key interface, not with a disclosed failure in on-chain trading logic.

Wallet exposure: Users who downloaded SKR Claim on November 1 and entered a seed phrase were told to consider the wallet compromised.
Device integrity: Solana Mobile said device security, the Seed Vault and on-chain systems were not compromised.
Separate app losses: Padre Terminal stole approximately $23,000 from 27 Solana wallets.
App verification: Security experts advised users to navigate directly from official project websites and exercise caution with applications that lack reputable developer credentials.

What is Solana Mobile doing after the breach?

Solana Mobile engineers patched the publishing-portal vulnerability following the incident. The company said it was conducting a broader security review to catch similar gaps before they could be used again.