Critical MediaTek Vulnerability: Seed Phrase Theft in 45 Seconds on 25% of Android Smartphones
📋 En bref (TL;DR)
- Critical MediaTek vulnerability: Ledger’s Donjon team identified a major vulnerability (CVE-2026-20435) in MediaTek chips’ secure boot chain
- Extraction in 45 seconds: an attacker with USB access can retrieve the PIN code and seed phrase from a crypto wallet in under a minute
- Attack method: electromagnetic pulses disrupt the chip at boot time, allowing security checks to be bypassed
- Compromised wallets: the proof-of-concept successfully extracted data from Trust Wallet, Kraken Wallet, and Phantom
- 25% of Android smartphones: all devices equipped with a MediaTek chip paired with the Trustonic secure system are potentially vulnerable
- Patch available: MediaTek delivered patches to manufacturers on January 5, 2026, and software updates are currently being rolled out
Your Android smartphone could betray your cryptocurrencies. On March 10, 2026, security researchers at Ledger Donjon revealed a critical vulnerability in MediaTek chips, found in a quarter of Android phones worldwide. By exploiting this vulnerability, an attacker with simple physical access and a USB cable can extract a device’s PIN code and a crypto wallet’s seed phrase in just 45 seconds.
The discovery, tracked as CVE-2026-20435, highlights a structural weakness in the hardware chain of trust relied upon by millions of users. Here is a closer look at a vulnerability that could change how cryptocurrency holders think about the security of their devices.
How the MediaTek vulnerability works
To understand this vulnerability, you first need to grasp the role of the secure boot chain. When a smartphone powers on, a series of checks ensures that each software layer loaded is authentic and has not been tampered with. This mechanism normally prevents malicious code from executing before the operating system even starts.
The Ledger Donjon team discovered that it is possible to disrupt this sequence by injecting targeted electromagnetic pulses into the MediaTek chip at the precise moment of boot. These physical disruptions, called “voltage glitches,” cause controlled errors in the processor. In practice, they force the chip to skip certain security verification instructions, as if a guard opened the door without checking the visitor’s identity.
Once the boot chain is compromised, the attacker gains privileged access to the Trusted Execution Environment (TEE) managed by Trustonic, a software component designed to protect the phone’s most sensitive data. The device’s PIN code, encryption keys, and seed phrases stored by wallet applications then become accessible.
The entire attack requires only a USB cable and specialized equipment. According to the researchers, full data extraction takes approximately 45 seconds.
Mobile wallets directly threatened
To demonstrate the severity of the vulnerability, the Donjon team carried out a proof-of-concept on three of the most widely used mobile wallets: Trust Wallet, Kraken Wallet, and Phantom. In each case, the researchers successfully extracted the seed phrase stored on the device.
Why are these wallets vulnerable?
Mobile wallets store the seed phrase in a secure area of the phone, protected by the TEE (Trusted Execution Environment). This mechanism relies on the assumption that the underlying hardware is trustworthy. However, the MediaTek vulnerability breaks precisely this assumption by compromising the hardware layer itself.
This is not a software bug that an application update could fix. It is a weakness in the silicon and in the way the processor handles its own security at boot. Wallet developers have no control over this layer. Their security depends entirely on the hardware provided by MediaTek and the secure software provided by Trustonic.
The three wallets tested are not the only ones affected. Any mobile crypto wallet that delegates seed phrase protection to the TEE of a MediaTek/Trustonic device is potentially exposed. This includes many lesser-known applications that lack the resources to implement additional layers of protection.
An important point: the attack does not target a flaw in the wallets’ own code. Trust Wallet, Kraken Wallet, and Phantom follow software security best practices. The problem lies one layer below, in the hardware and secure software these applications rely on. This is what makes this vulnerability particularly concerning: application developers cannot fix it on their end.
A quarter of Android smartphones affected
The scope of the vulnerability is considerable. MediaTek is the world’s largest smartphone chip manufacturer by volume. Its processors power a wide range of devices, from entry-level phones to mid-range models sold by Samsung, Xiaomi, Oppo, Vivo, Realme, and many other manufacturers.
According to the researchers’ estimates, approximately 25% of Android smartphones in circulation combine a MediaTek chip and the Trustonic secure system, the two components required to exploit the vulnerability. This represents hundreds of millions of devices worldwide.
Who is not affected?
Phones equipped with Qualcomm Snapdragon or Samsung Exynos chips are not affected by this specific vulnerability. Apple iPhones, which use their own chips and a different secure environment, are also not affected. Similarly, hardware wallets such as those from Ledger or Trezor are not impacted, as they use dedicated secure chips specifically designed to withstand this type of physical attack.
However, one point deserves attention: even if your hardware wallet is secure, if you ever entered or displayed your seed phrase on a vulnerable Android phone, that information could theoretically have been compromised. The security of a seed phrase depends on every device that has handled it, not just the one where it is permanently stored.
MediaTek’s response and patch timeline
Ledger Donjon followed a responsible disclosure process. The researchers informed MediaTek of the vulnerability before any publication, giving the manufacturer time to prepare a fix. MediaTek delivered security patches to smartphone manufacturers on January 5, 2026.
However, patch deployment remains a concern. In the Android ecosystem, security updates go through a complex chain: MediaTek provides the patch, the phone manufacturer integrates it into its own software, then rolls it out to users. This process can take weeks or even months, depending on the manufacturer and model.
Affected users should verify that their phone has the latest security updates. The patch for CVE-2026-20435 should appear in the Android security bulletins for March or April 2026. Older phones that no longer receive updates will remain vulnerable indefinitely.
How to protect your cryptocurrencies
While waiting for the patch to be deployed to all devices, several measures can reduce the risks.
Immediate steps
The first recommendation is to check the chip manufacturer of your phone. On Android, this information is available in Settings, About Phone, then Processor. If your device uses a MediaTek chip (references generally start with “Dimensity” or “Helio”), you are potentially affected.
Next, install all available updates immediately. Enable automatic updates if you haven’t already. Regularly check the Android security patch level in your phone’s settings.
For holders of significant cryptocurrency amounts, the most robust solution remains using a hardware wallet. These dedicated devices are designed to withstand physical attacks and do not depend on the phone’s security. The seed phrase never leaves the hardware wallet’s secure chip.
Long-term best practices
This incident serves as a reminder of a fundamental principle: never enter or display a seed phrase on an internet-connected device. Not even temporarily. Not even for a “quick check.” Every device that handles this information becomes a potential attack vector.
Users who store significant amounts should also consider a diversification strategy. Keeping all funds on a single device or a single wallet creates a single point of failure risk. Splitting between a hardware wallet for savings and a mobile wallet for small daily transactions limits exposure in the event of a compromise.
What this reveals about mobile security
The Ledger Donjon discovery goes beyond cryptocurrencies. It highlights a reality that is often overlooked: smartphone security relies on a complex chain of trust where each link can become the weak point. Users trust their phones to protect their banking data, passwords, and private keys. But this trust assumes the underlying hardware is impregnable.
Fault injection attacks are not new in the cybersecurity world. They have been used for years to compromise smart cards and embedded systems. But their application to consumer smartphones, with such a high success rate and such a short execution time, marks a significant escalation.
For the crypto industry, this episode strengthens the argument for dedicated hardware storage solutions. The convenience of a mobile wallet should not overshadow the fact that a phone’s security depends on decisions made by chip manufacturers, secure software vendors, and phone makers — actors over whom the end user has no control.
This discovery comes at a time when cryptocurrency adoption through mobile applications is reaching record levels. Millions of users worldwide store significant funds on their phones, often without awareness of the underlying hardware risks. The CVE-2026-20435 vulnerability is a reminder that in the crypto world, security is not limited to choosing a strong password or enabling two-factor authentication. It starts at the silicon level.
Glossary
- Seed phrase (recovery phrase): A sequence of 12 or 24 words generated when creating a crypto wallet. It allows restoring access to all associated funds. Anyone who knows this phrase controls the wallet’s cryptocurrencies.
- Secure boot: A security mechanism that verifies the authenticity and integrity of each software component loaded at device startup. It prevents unauthorized code from executing before the operating system launches.
- TEE (Trusted Execution Environment): An isolated area within a smartphone’s processor, designed to execute sensitive code and store critical data (keys, PIN) separate from the main operating system.
- Hardware wallet: A dedicated physical device for storing crypto private keys. Isolated from the internet, it signs transactions internally without ever exposing the keys, providing a higher level of security than software wallets.
- Voltage glitch (fault injection): A physical attack technique involving sending electromagnetic or electrical pulses to disrupt the normal operation of a processor. These disruptions can force the chip to skip security instructions.
- CVE (Common Vulnerabilities and Exposures): An international reference system that assigns a unique identifier to each discovered security vulnerability. The CVE-YEAR-NUMBER format allows vulnerabilities to be tracked and documented in a standardized manner.
Frequently Asked Questions
Is my Android smartphone affected by the MediaTek vulnerability?
Only smartphones equipped with a MediaTek chip paired with the Trustonic secure system are vulnerable, representing approximately 25% of Android phones. To check, go to Settings, About Phone, then Processor. MediaTek chips generally carry the names Dimensity or Helio. Phones with Qualcomm Snapdragon or Samsung Exynos chips are not affected.
Has the vulnerability been patched?
MediaTek delivered a patch to smartphone manufacturers on January 5, 2026. However, deployment depends on each manufacturer. Make sure your phone has the latest Android security updates. The patch for CVE-2026-20435 should be included in the March or April 2026 security bulletins.
Are my cryptocurrencies at risk if I use Trust Wallet or Phantom on Android?
If your phone uses a MediaTek chip with Trustonic and an attacker gains physical access to your device via USB, they could theoretically extract your seed phrase in 45 seconds. Install security updates immediately and consider transferring your funds to a hardware wallet for significant amounts.
Does a hardware wallet protect against this vulnerability?
Yes. Hardware wallets such as Ledger or Trezor use dedicated secure chips that are not affected by the MediaTek vulnerability. The seed phrase never leaves the device. However, if you have previously entered your seed phrase on a vulnerable Android phone, that information could have been compromised.
Can the attack be carried out remotely?
No. This attack requires physical access to the device and a USB connection. It cannot be exploited remotely via the internet or Bluetooth. The risk primarily concerns theft or unauthorized access scenarios.
Sources
This article is based on the following sources:
- Decrypt — Android Phone Crypto Wallets Could Be Exposed to Exploit: Here’s Who Is at Risk (March 2026)
- CryptoNews — Ledger Researchers Expose Android Flaw Enabling Wallet Seed Theft (March 2026)
- Cointelegraph — Crypto Seed Phrase Exploit on Android Phones Exposed by Ledger (March 2026)
- The Block — Ledger Researchers Expose Android Flaw Enabling Theft (March 2026)
How to cite this article: Fibo Crypto. (2026). Critical MediaTek Vulnerability: Seed Phrase Theft in 45 Seconds on 25% of Android Smartphones. Retrieved March 12, 2026 from fibo-crypto.fr
