Hackers slip seed phrase stealer into Solana Mobile app store

Solana Mobile, the company behind the Seeker crypto phone, said on Sunday that a malicious app called "SKR Claim" was placed in its Solana dApp Store after someone gained unauthorized access to the store's dApp Publishing Portal. The app asked users to type in their wallet seed phrases, the company said at 18:34 UTC.

The app was featured in the store's App Spotlight for one hour before it was removed. Solana Mobile said the App Spotlight and Quests sections of the store were changed through the same access, and that it was removing the app from devices where it had been installed.

A seed phrase restores a wallet on any device, so whoever holds it can move everything in that wallet. Solana Mobile said its team "will never ask you for your seed phrase, for crypto, or to connect your wallet to other apps/sites to claim airdrops."

How the app reached the spotlight

After reviewing the incident, Solana Mobile said, its team "identified and patched a bug that allowed linking to apps that were not fully published." The company did not say whether "SKR Claim" had passed the store's review, or how the portal access and the linking bug were used together.

Developers submit Android and web apps to the dApp Store through the Publishing Portal and must follow the store's publisher policy, according to Solana Mobile's developer documentation. Submitted apps go into a review queue and go live once approved, Cryptonews reported, citing The Defiant.

SKR and how it is claimed

SKR is the token Solana Mobile uses for governance and staking across its platform. Seeker owners claim their SKR inside the phone's built-in Seed Vault Wallet, from its Activity Tracking tab, and developers claim theirs through the same Publishing Portal, the company's launch post says. The instructions do not involve entering a seed phrase. Staked SKR is delegated to Guardians, who among other things coordinate dApp reviews, according to the same post.

What is not known

Solana Mobile has not said how the attacker got into the Publishing Portal, how many devices installed the app, or whether anyone lost funds, Cryptonews noted. It also has not said how removal from devices works.