Android flaw exposes 30M wallets holding crypto

TLDR

A serious Android SDK flaw temporarily exposed about 30 million crypto wallet installs to potential theft, but patches and Play Store protections are now available.

1. Microsoft found an EngageLab SDK bug that let malicious apps bypass Androids sandbox and read wallet seed phrases across more than 30 million wallet installs.
2. Google and EngageLab have shipped fixes, and there is currently no public evidence of mass exploitation, but unupdated or sideloaded apps remain at higher risk.
3. For crypto users, up to date wallet apps, avoiding random APKs, and keeping larger holdings off mobile hot wallets are now even more important security habits.

Deep Dive

1. What The Android Flaw Actually Did

Microsofts Defender Security Research Team disclosed an Android native vulnerability in EngageLabs EngageSDK (version 4.5.4) that impacted over 50 million app installs, including around 30 million crypto wallets worldwide.

The issue was an intent redirection bug in a component added by the SDK, which let a hostile app on the same device trick vulnerable apps into granting read and write access to their private data, including wallet seed phrases and addresses. In practice, just having a malicious app plus an affected wallet app on the same phone could have been enough for compromise, even without obvious user mistakes.

A detailed breakdown describes how the exported activity and unsafe URI permissions let attackers escape Androids normal sandbox and reach non exported wallet files across many apps using the same SDK.

2. Who Is Most At Risk Now

Microsoft reported the flaw was present from at least early 2025 but also said there was no evidence of broad active exploitation at the time of disclosure. That lowers panic but does not eliminate risk.

EngageLab fixed the SDK in version 5.2.1, and Google Play removed vulnerable wallet builds and added automatic mitigations for already installed versions, which should cover users who keep their apps updated through the Play Store.

The biggest remaining exposure is for users who installed affected wallet apps as APKs from websites or who have not updated their wallet apps since mid 2025. Those installs may have missed both the patched SDK and Play Store protections.

3. Practical Takeaways For Crypto Users

From a risk perspective, mobile wallets are hot wallets: convenient but inherently more exposed than hardware or well secured desktop setups, and this Android case underlines that gap.

Security teams recommend a few high level patterns: favor reputable wallets that update frequently through official app stores, regularly check for updates, and treat any wallet that was installed long ago and rarely updated as higher risk until refreshed.

For larger balances, many users keep only a small spending amount on mobile, with most holdings in hardware or other offline style wallets, which are not affected by this Android SDK issue.

Conclusion

The Android EngageLab SDK flaw shows how a single third party component can silently widen the attack surface for millions of crypto wallets, even when individual apps do nothing wrong. Patches and Play Store mitigations mean most attentive users are now safer, but outdated or sideloaded wallet apps still pose a significant risk, reinforcing the case for disciplined updates and keeping serious holdings off everyday mobile hot wallets.