Key Takeaways:

• Ledger discovered the flaw in MediaTek processing hardware.
• The vulnerability used power leakage to determine passwords and seed phrases.
• The issue has been fixed since it was reported to the processor manufacturer.

Researchers at Ledger identified a critical security flaw in Android devices that could allow attackers to extract cryptocurrency seed phrases in under a minute. 

The vulnerability specifically targeted the way MediaTek mobile processors handle sensitive data, potentially leaving millions of mobile wallet users exposed to theft.

Processors leak power, and this can be used against you

The discovery focuses on how hackers can monitor the electromagnetic pulses (short bursts of energy) that processors make whenever they operate. All mobile processors can leak a bit of power. By observing these tiny physical changes while a user enters their recovery phrase, hackers can reconstruct it.

Ledger demonstrated this in a controlled environment, capturing the leaking energy and reconstructing the seed phrase in as little as 45 seconds. The seed phrase is like a master key that can help access a wallet, even if the password or private key is lost. If a hacker gains access to the seed phrase, they have total control over the wallet assets.

Unlike a bank account, crypto transactions are not reversible. Once a wallet is compromised, the funds can be drained, gone forever.

Ledger researchers used a Mediatek processor

The Ledger research highlighted that devices powered by MediaTek chipsets, commonly found in budget and mid-range smartphones, are particularly susceptible to this type of attack. Because these chips are widely used globally, the potential fallout is massive.

While there are no reports yet of this being used by criminals, the proof of concept from Ledger serves as a serious wake-up call for mobile-first crypto holders.

However, the weakness identified was reported to mobile manufacturers and other vendors. Chief technical officer at Ledger, Charles Guillemet, confirmed in a follow-up tweet that MediaTek had fixed this issue in January 2026.

How to protect your crypto assets

Even if the vulnerability is fixed, there is always a chance for bad actors to find loopholes in security. MediaTek processor or not, you should take certain steps to protect your assets.

• Use cold storage: The most effective defense is to move your funds to a cold wallet. These devices keep your seed phrase completely offline, meaning hackers cannot access your seed phrase when the device is not connected online. Though they are not 100% immune to hacks.
• Use a dedicated mobile device: If you must use a mobile hot wallet, avoid using that same phone for everyday web browsing or downloading unverified apps.
• Use additional layers of security: Things like biometrics, two-factor authentication (2FA), and other security measures on top of your mobile PIN can make it more difficult for hackers.
• Keep software updated at all times: Manufacturers often release security patches. Ensure that your mobile operating software and apps are on the latest version provided.

Glossary of terms: 

• Seedphrase: A series of random words that act as a master key to recover wallet access.
• Cold storage: specialised hardware wallets that can be physically disconnected from the blockchain to keep crypto assets safe.
• Hot wallet: a mobile or computer-based wallet, which is always online as long as the device is connected to the internet.