A malicious “SKR Claim” app appeared on Solana Seeker’s dApp Store for about an hour after a breach of the developer portal. The app asked users for their seed phrases. The team has since removed it and patched the bug.
Why it matters
A seed phrase can give someone control over the assets secured by a wallet. An app that requests it can therefore put users at risk of wallet theft, even when it appears in a curated store.
Market impact
The team says the app is no longer available and the bug has been patched. The seed does not report whether any users submitted phrases or lost funds. For Solana users, the incident underscores the importance of never entering a seed phrase into an app or sharing it with another party.
Frequently asked questions
-
How did the malicious app reach Solana Seeker’s dApp Store?
Solana Seeker said a breach of its developer portal allowed the “SKR Claim” app to appear in the store.
-
What information did the “SKR Claim” app request?
The app asked users for their seed phrases, which can provide control over the assets secured by a wallet.
-
How long was the app available?
The app was on the dApp Store for about an hour before the team pulled it.
-
What steps did the Seeker team take?
The team removed the app and patched the bug that allowed it to go live.
-
Did the incident result in user losses?
The report does not say whether users submitted seed phrases or lost funds.
CryptoSlate
WuBlockchain
TheBlock
CoinDesk