BlockBeats report: On March 11, Donjon, the security research team under the crypto wallet Ledger, discovered a security vulnerability in the MediaTek Dimensity 7300 chip. An attacker with physical access to the device can extract encryption keys via USB before the operating system loads, decrypt the device’s storage, and obtain the device PIN and crypto wallet recovery phrase in approximately 45 seconds. In proof-of-concept tests, the vulnerability successfully extracted sensitive data from wallet applications including Trust Wallet, Kraken Wallet, and Phantom.
Researchers stated that the vulnerability may affect approximately 25% of Android phones, including models using MediaTek chips and the Trustonic Trusted Execution Environment. Charles Guillemet, Chief Technology Officer at Ledger, said smartphones were never designed to function as vaults; although the vulnerability can be patched, it highlights the inherent risk of storing keys on non-secure devices, and users are advised to apply security updates as soon as possible.