MediaTek Chip Flaw Allows Data Extraction from Off Android Phones

Security researchers at Ledger, a cryptocurrency hardware wallet company, have uncovered a critical vulnerability in MediaTek chipsets that could allow attackers to extract sensitive data from Android smartphones in under 45 seconds, even when the devices are powered off. The flaw, identified as CVE-2025-20435, affects millions of devices worldwide and was responsibly disclosed to MediaTek, which provided a patch to device manufacturers on January 5, 2026.

Ledger's internal research team, Donjon, demonstrated the exploit on a Nothing CMF Phone 1, a budget Android device powered by the MediaTek Dimensity 7300 processor. By connecting the phone to a laptop via USB, the researchers bypassed the device's secure boot chain—a mechanism designed to ensure only authorized software loads during startup—without ever activating the Android operating system. In the process, they recovered the phone's PIN, decrypted its encrypted storage, and retrieved seed phrases from several popular software cryptocurrency wallets, including Trust Wallet, Base, Kraken Wallet, Rabby, Tangem's mobile wallet, and Phantom. Seed phrases serve as master keys for recovering access to digital assets, making them...