Crypto wallets on Android are at risk — new malware bypasses protection in seconds

The Ledger 's Donjon team has reported a critical vulnerability in the secure boot chain of MediaTek processors that could allow attackers with physical access to the device to extract PINs and crypto wallet seed phrases in about 45 seconds. The study showed that the weakness is in the firmware of Android phones with MediaTek chips.

In the proof-of-concept tests, the exploit allowed recovering confidential data from Trust Wallet, Kraken Wallet, and Phantom wallets. According to the researchers, an attacker can connect a phone via USB to boot the operating system, obtain the cryptographic keys that protect the disk encryption, and decrypt the data offline. «This proves what we have long warned: smartphones were never designed to be safes,» said Ledger CTO Charles Guillemette.

According to estimates, the vulnerability could affect about 25% of Android devices, including models from manufacturers using MediaTek and the Trustonic trusted environment. The Ledger emphasized that the purpose of the publication is to give the industry time to fix the problem before it is exploited by attackers. Donjon has previously discovered critical vulnerabilities in Android chips and PIN bypass attacks in competing wallets.

Guillemet urged users to update their devices to the latest security patches provided by MediaTek and phone manufacturers. He emphasized that the security of cryptocurrencies on smartphones depends on the weakest link in the hardware or software environment.

The report comes amid a rise in attacks on cryptocurrency wallets. According to TRM Labs, in the first half of 2025, infrastructure attacks accounted for more than 80% of the $ 2.1 billion stolen. In total, losses from crypto theft exceeded $ 3.41 billion over the year, and the share of personal wallet compromises increased from 7.3% in 2022 to 44% in 2024, affecting more than 158,000 cases.