TLDR
Ledgers security team has disclosed a serious MediaTek Android flaw that can expose crypto keys on many phones if an attacker gets brief USB access.
- Ledgers Donjon team found a MediaTek chip vulnerability that can let attackers decrypt some Android phones and extract wallet seed phrases and PINs in under a minute.
- The issue mainly affects Android devices using MediaTek chips with Trustonics secure enclave, and it threatens mobile wallets, 2FA apps, and password managers, not Ledger hardware wallets.
- MediaTek has shipped a fix to manufacturers, so the key protections now are OS and firmware updates plus keeping large holdings on dedicated hardware wallets instead of phones.
Deep Dive
1. What Ledgers Team Found
Ledgers in-house Donjon security team identified a critical vulnerability in Android phones using MediaTek processors and Trustonics Trusted Execution Environment that can bypass full-disk encryption before Android even boots. In a proof of concept, they connected a Nothing CMF Phone 1 to a laptop via USB, recovered the PIN, decrypted the storage, and pulled seed phrases from six popular wallet apps (including Trust Wallet, Base, Kraken Wallet, Rabby, tangem, and Phantom) in about 45 seconds on this report.
A CoinsKid community summary notes that MediaTek chips power devices from brands like Xiaomi, Oppo, Vivo, Realme and others, so a large slice of the Android market is indirectly exposed if running vulnerable firmware in this overview.
This is not a wallet-app bug but a deep hardware/firmware issue that can undermine any encrypted data on affected phones.
2. Who Is Actually At Risk
The attack requires physical USB access to the phone while it is in a vulnerable state, so it is not a remote internet exploit. The main scenarios are lost or stolen devices, border or law-enforcement seizures, or untrusted repair or charging situations.
Because the flaw lets attackers grab root cryptographic keys and then decrypt storage offline, anything stored on the device is at risk, including mobile wallet private keys, seed phrases, 2FA secrets, password manager vaults, and VPN credentials as highlighted here.
Ledger states that iPhones, non-Android devices, and dedicated Ledger hardware wallets are not affected, since those keep keys inside separate secure chips rather than in the phones main memory.
If your main crypto keys live only on a vulnerable Android phone, a brief physical compromise could be enough to clone them without you noticing.
3. Practical Steps And What To Watch
Ledger followed a standard 90-day responsible disclosure process, reporting the vulnerability to MediaTek and Trustonic; MediaTek says it delivered a fix to device makers in January according to this disclosure. The remaining risk is patch rollout and whether users install those updates.
Security-focused users typically:
- Install the latest Android system and security updates on any MediaTek phone as soon as they are available.
- Avoid keeping large balances or seed phrases directly on phones, preferring hardware wallets or multisig for long-term storage.
- Treat old or unsupported Android devices as unsafe for key storage if they no longer receive firmware patches.
The near-term defense is updating your phone and reducing how much must not be stolen information is stored on it; longer term, watch for OEM patch announcements and treat phones as convenience tools, not cold storage.
Conclusion
Ledgers finding reinforces a long-running security lesson: smartphones are convenient for spending and interacting with crypto, but their hardware and firmware stack is complex and hard to fully trust. This Android vulnerability shows that even encrypted phones can leak keys if the underlying chip or secure enclave is flawed, so keeping critical seed phrases and large holdings on purpose-built hardware wallets remains the safer default for most users.
CoinsKid.Com