Android Phone Crypto Wallets Could Be at Risk Due to MediaTek Exploit: Ledger

A significant security flaw discovered by Ledger researchers could allow attackers to extract encrypted user data from certain Android smartphones powered by MediaTek processors in approximately 45 seconds. The exploit, demonstrated on a Nothing CMF Phone 1, enables the retrieval of a device PIN and decryption of storage even before the Android operating system boots up.

Exploit Details and Impact

Ledger's internal security team, Donjon, successfully demonstrated the vulnerability by connecting a compromised device to a laptop via USB. They were able to recover the phone's PIN, decrypt its storage, and extract seed phrases from several popular software crypto wallets, including Trust Wallet, Base, Kraken Wallet, Rabby, Tangem's mobile wallet, and Phantom. This occurred without booting Android, highlighting a critical weakness in the device's secure boot chain.

Charles Guillemet, Ledger's Chief Technology Officer, noted on X that the exploit potentially impacts millions of Android phones and serves as a reminder that smartphones are not inherently built for security. He emphasized that even powered-off devices could have user data, including PINs and seed phrases, extracted rapidly.

Broader Implications and Affected Devices

While the demonstration focused on cryptocurrency wallets, Donjon stated that the vulnerability could extend to other sensitive information on the device, such as messages, photos, financial data, and account credentials. The exploit targets the phone's secure boot chain, allowing attackers to access root cryptographic keys before the OS loads, thereby enabling offline storage decryption.

The Nothing CMF Phone 1, released in 2024, runs the Android operating system. MediaTek chips are used in a wide range of devices, including other crypto-focused phones like the Solana Seeker, and smartphones from major brands such as Samsung, Motorola, Xiaomi, POCO, Realme, Vivo, OPPO, Tecno, and iQOO. However, it remains unclear which specific models beyond the Nothing CMF Phone 1 are susceptible.

This discovery comes at a time when personal wallet compromises are increasingly contributing to cryptocurrency theft. A July 2025 Chainalysis report indicated that such compromises accounted for 23.35% of all stolen fund activity year-to-date.

Disclosure and Mitigation

Ledger disclosed the vulnerability to MediaTek and Trustonic under a 90-day responsible disclosure policy. MediaTek publicly disclosed the issue earlier this month, having issued a fix to device makers in January. While MediaTek addressed the issues, they did not publicly comment until March.

Guillemet contrasted the security of general-purpose chips found in smartphones with dedicated Secure Elements, stating that the latter are specifically designed for key protection and isolate secrets from the rest of the system, offering greater security even under physical attack.