Critical Android Vulnerability Exposes Encryption Keys and Crypto Wallet Data Security researchers at Ledger’s Donjon team have uncovered a severe vulnerability in certain Android smartphones, potentially affecting up to 25% of devices worldwide. The flaw, tied to specific MediaTek chipsets using Trustonic’s Trusted Execution Environment (TEE), allows attackers with brief physical access to extract sensitive data including encryption keys and cryptocurrency wallet seed phrases in under a minute. The issue stems from a weakness in the device’s boot chain, a security mechanism that validates system components during startup. Normally, this process protects encryption keys until the OS fully loads. However, researchers demonstrated that by connecting a vulnerable phone to a computer via USB, attackers could bypass security protections before the OS completes booting. In a proof-of-concept test using a Nothing CMF Phone 1, the Donjon team recovered the device’s PIN, decrypted storage, and extracted seed phrases from six crypto wallets Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom within 45 seconds. The vulnerability, tracked as CVE-2026-20435 in MediaTek’s security bulletin, affects devices relying on certain MediaTek processors, which are prevalent in budget and midrange Android phones. MediaTek has issued a firmware fix to manufacturers, but users must install pending updates to mitigate the risk. Until then, affected devices remain exposed to offline decryption attacks once root cryptographic keys are extracted. Ledger’s CTO, Charles Guillemet, noted that smartphones were not designed as secure storage for digital assets, emphasizing that their security depends on the integrity of hardware, firmware, and software. The discovery underscores the risks of storing sensitive data on mobile devices without additional safeguards.