Ledger Security Researchers Hack Switched-Off Mediatek Android Phone In Under A Minute

A security research team has demonstrated how a critical vulnerability in MediaTek-powered Android smartphones can allow an attacker to extract user data – including messages, photos and crypto wallet seed phrases – in a matter of seconds.

Ledger’s in-house white-hat hacking team, the Donjon, carried out the proof-of-concept attack on a Nothing CMF Phone 1. The researchers plugged the device into a laptop and breached the phone’s foundational security within 45 seconds.

The phone did not need to be switched on for the attack to work.

Without booting into Android, the exploit automatically recovered the phone’s PIN, decrypted its storage and extracted seed phrases from several popular software wallets, including Trust Wallet, Base, Kraken Wallet, Rabby, Tangem’s Mobile Wallet and Phantom.

How the exploit works

The vulnerability sits in MediaTek’s secure boot chain. Before the operating system even loads, an attacker can connect over USB and extract the root cryptographic keys that protect Android’s full-disk encryption.

From there, the phone’s storage can be decrypted offline and the PIN brute-forced in seconds, unlocking all application data including wallet seed phrases.

The Donjon team uncovered the flaw while investigating the security behind flash encryption in the Android OS.

MediaTek’s chips are found in roughly a quarter of all Android phones. The vulnerability has the potential to affect Android smartphones using Trustonic’s Trusted Execution Environment (TEE) and MediaTek processors, a combination that could impact hundreds of millions of devices worldwide and up to 2 million users in Australia alone. The Solana Seeker phone is also among the affected devices.

A warning for crypto holders

Ledger Chief Technology Officer, Charles Guillemet, warned that the findings highlight fundamental limitations in smartphone security.

“This research proves what we’ve long warned: smartphones were never designed to be vaults,” Guillemet explained. “While this can be patched, and we encourage all users to update with the latest security fixes provided by MediaTek and phone manufacturers, it shows the challenge of storing secrets on non-secure devices.”

“If your crypto sits on a phone, it’s only as safe as the weakest link in that phone’s hardware, firmware or software,” he added.

Guillemet stressed that the Donjon publishes its research to help the industry improve, not to cause alarm.

“The Ledger Donjon doesn’t publish this research to create fear – they publish it so the industry can fix it. That’s what the Donjon exists to do.”

Responsible disclosure and patch timeline

Ledger disclosed the vulnerability to both MediaTek and Trustonic, following the industry-standard 90-day responsible disclosure process.

MediaTek confirmed it provided a fix for the vulnerability on 5 January 2026 to affected original equipment manufacturers. The existence of the vulnerability was made public on 2 March 2026 and has been assigned the identifier CVE-2025-20435.

Users of phones with affected chips are being urged to install the latest security updates as soon as possible.

Broader security implications

The disclosure is the latest in a series of findings from the Donjon team, which has previously uncovered vulnerabilities affecting Android chips and exposed PIN bypass attacks in competitor hardware wallets.

The Donjon operates as Ledger’s internal security research unit, dedicated to auditing, testing and improving security across the digital asset ecosystem. Beyond hardening Ledger’s own devices, the team routinely probes third-party hardware and software, disclosing vulnerabilities responsibly so they can be patched before they are exploited by malicious actors.

The research also underscores the ongoing tension between convenience and security in the smartphone ecosystem. Zero-click exploits can take complete control of a phone and allow attackers to steal private keys without any user interaction, making dedicated hardware security devices a preferred option for those holding significant digital assets.

Upgradeable firmware remains a key feature in the security arms race, ensuring zero-day exploits can be addressed where possible. However, the window between discovery and patch deployment continues to represent a period of risk for affected users.

Last Updated on March 14, 2026 by Nick Ross