Cybersecurity researchers have identified a fraudulent airdrop application that infiltrated the official Solana dApp Store, using a fake token distribution interface to harvest 12- and 24-word wallet recovery phrases. The malicious app, named 'SKR Claim', was submitted on November 2 and remained live until community reports led to its removal. Solana Mobile confirmed that the App Spotlight and Quests UI were updated following unauthorized access to the dApp Publishing Portal.
According to forensic analysis, the app did not perform real blockchain interactions. It instead blocked progress until victims manually entered a complete mnemonic phrase, then transmitted the credentials via encrypted requests to an external command-and-control server. Investigators said the attackers bypassed store review filters through deferred payload delivery, first submitting a compliant build and later enabling hostile features remotely.
The app accumulated thousands of downloads before detection. It targeted both self-custody browser extension wallets and mobile storage solutions. The associated domain used SSL certificates issued only days before the campaign, and registration records were anonymized to obscure the operators' identities. Cybersecurity firms notified store administrators, and the package identifier was removed after verification of hostile behavior.
The incident came as Solana co-founder Anatoly Yakovenko warned that phishing and social engineering now pose the biggest threat to crypto users, rather than advanced cryptographic or quantum attacks. He recommended a dedicated iOS device with Apple Lockdown Mode combined with a multisignature wallet as a low-cost security setup. Lockdown Mode blocks many attachment types, restricts web technologies, and prevents new configuration profiles, while a multisig wallet requires multiple approvals before transactions execute.
Yakovenko's comments followed two major exchange security incidents. Binance reported $6.34 billion in affected assets after an October 29 attack, later explaining that fake job interviews and compromised developer software helped attackers reach wallet signing systems. The exchange said malicious code replaced the pyenv development tool, and on October 20 the attacker used an infected computer and an internal AI tool to compromise two wallet engineers. Binance said the attacker used Ethereum's EIP-7702 feature to maintain permissions on the hot wallet known as Binance 14. Mercado Bitcoin suspended deposits and withdrawals after detecting a breach on November 2, and Tether froze 4.5 million USDT connected to that incident.
Chainalysis recorded 158,000 personal wallet theft incidents in 2025, affecting at least 80,000 unique victims, with losses totaling $713 million. Solana had the largest absolute victim count at roughly 26,500, though victimization rates were lower than Ethereum and Tron when adjusted for active wallets. The FBI has separately warned that investment scams often begin with unsolicited messages and fictitious returns, advising users to verify contacts independently and avoid links or attachments from unknown sources.
