Mobile chipset manufacturer MediaTek has recently resolved a significant security vulnerability that threatened the crypto seed phrases of users. Discovered by Ledger’s white-hat security team, the flaw allowed cryptographic seed phrases to be stolen from certain Android devices within just 45 seconds when connected to a computer via USB.
This vulnerability, tied to MediaTek’s secure boot chain—a security feature essential for starting devices safely—was communicated to MediaTek before a patch was implemented on January 5. Ledger emphasizes that users who haven’t updated their devices should do so immediately.
Device Under Attack in Under a Minute
According to Ledger, the vulnerability arises from the secure boot mechanism, which is designed to ensure that devices boot using only authorized software. When tested, the exploit was able to extract sensitive information, including crypto seed phrases, without even needing to boot into Android.
Approximately 25% of Android smartphones rely on MediaTek processors that are susceptible to this exploit. The Donjon team successfully demonstrated how to access a Nothing CMF Phone 1 by connecting it to a laptop, compromising security in around 45 seconds.
By executing the exploit, they retrieved the phone’s PIN, decrypted its storage, and accessed seed phrases from several popular wallets including Trust Wallet, Base, and Kraken Wallet.
While Ledger advises users to update, they do not expect this vulnerability to persist. Still, with nearly 36 million people managing assets on their smartphones, even one security hole poses serious risks.
In a related testing conducted in December 2025, Ledger reported that they bypassed security measures on the MediaTek Dimensity 7300, taking complete control of the smartphone. Charle Guillemet, Ledger’s CTO, reiterated that smartphones—regardless of the operating system—present substantial security challenges for crypto applications.
He highlighted ongoing insecurities in smartphones, stating that user data could be extracted even when the device is powered off. Guillemet also stressed that general-purpose chips prioritize convenience over security, contrasting them with Secure Elements designed specifically for effective key protection.
