Back Bitget

Ledger researchers discover Android vulnerability that can steal wallet seed phrases in seconds

Bitget • March 11, 2026

Foresight News reported, according to monitoring by The Block, that Ledger's research team has discovered a serious security vulnerability present in Android phone firmware using MediaTek processors. Attackers can extract the device's PIN code and crypto wallet private keys within approximately 45 seconds. The vulnerability exploits weaknesses in MediaTek's secure boot chain, allowing attackers to connect the phone via USB and extract the keys protecting Android's full disk encryption before the operating system loads, then decrypt the storage offline. Researchers pointed out that this vulnerability may affect 25% of Android phones, including some manufacturers using MediaTek chips and Trustonic's Trusted Execution Environment.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MediaTek Chip Vulnerability Exposes 25% of Android Phones to Data Theft A critical vulnerability affecting MediaTek processors in Android smartphones allows attackers to extract sensitive user data, including PINs and cryptocurrency wallet seed phrases, in under 45 seconds. Discovered by Ledger's Donjon security team, the flaw exploits weaknesses in the secure boot chain of affected devices, enabling unauthorized access via a USB connection. This vulnerability could impact approximately 25% of Android phones globally, particularly those utilizing Trustonic's Trusted Execution Environment (TEE). The issue has been publicly disclosed as CVE-2026-20435, and MediaTek has issued a firmware patch to device manufacturers. Users are advised to ensure their devices are updated with the latest security patches to mitigate risks. The vulnerability has been present for potentially a decade without prior detection. Ledger's CTO emphasized the need for improved security in smartphones, which are often not designed to safeguard sensitive data effectively. 23 sources 71

Ledger researchers discover Android vulnerability that can steal wallet seed phrases in seconds

The full story

Extracted Entities

Companies (1)

Platforms (1)