Ledger Reveals Unstoppable Attack Targeting MediaTek Phone Chips

A critical flaw in MediaTek's widely-used smartphone chipsets has been exposed, posing a direct threat to mobile security. The vulnerability, described by hardware wallet maker Ledger, could allow attackers to bypass fundamental device protections.

The Root of the Problem

The exploit targets a core component within the chip's boot process. Researchers found a way to manipulate this system, granting near-total control over the device. It's not a simple software bug—it's a hardware-level weakness that existing security patches can't easily fix.

Why This Matters for Crypto

For anyone using their phone for cryptocurrency transactions, this is a wake-up call. Mobile wallets, exchange apps, and even two-factor authentication become potential targets if the device itself is compromised. It turns your pocket-sized computer into a potential backdoor.

The Unpatchable Reality

MediaTek chips power billions of devices globally, particularly in mid-range and budget smartphones. The scale of the potential exposure is massive. While manufacturers scramble for mitigations, the fundamental nature of the flaw means a truly complete fix may require new hardware.

Security in a Compromised World

This revelation forces a hard look at mobile-centric security models. It underscores the non-negotiable value of dedicated, air-gapped hardware for safeguarding private keys. Your phone is for convenience; your crypto vault shouldn't be.

In an industry where 'secure enough' is often the sales pitch, this is a blunt reminder that the chain is only as strong as its weakest link—and sometimes that link is soldered onto the motherboard. It's the kind of news that makes you wonder if your phone's 'security update' is just digital wallpaper over a cracked foundation.

How the attack works

Researchers Charles Christen and Léo Benito say they used electromagnetic fault injection (EMFI), a method that sends a rapid electromagnetic pulse to temporarily disrupt the processor’s operations. They were able to make it skip critical security checks by targeting the chip during the very first instructions it runs at boot.

This lets the team get around restrictions that usually block access to protected memory areas. They accessed the boot ROM, which contains the device’s most privileged code. Eventually, they ran arbitrary code at the chip’s highest security level (EL3). At this point, an attacker can control memory, the boot process, security settings, and any data saved on the phone.

While this attack needs physical access to the device and specific tools, the implications are serious. Many crypto users keep their private keys on their smartphones. Once an attacker gains full control of the chip, they can extract those keys, threatening the user’s crypto assets. 

Ledger highlighted the danger clearly by saying, “There is simply no way to safely store and use one’s private keys on those devices.”

An unpatchable flaw

The vulnerability is in the chip’s hardware itself, not its software, so it cannot be fixed through updates or security patches. All devices using the MT6878 remain permanently exposed. 

Although each attack attempt succeeds only 0.1% to 1% of the time, researchers can repeat it every second by repeatedly rebooting the device. This means that once an attacker has physical access to the phone, a successful breach is a matter of minutes.

MediaTek’s response

MediaTek said electromagnetic fault-injection attacks are outside the MT6878’s intended threat model. The chip was built for general consumer smartphones, not for hardware wallets or financial devices that require protection against physical attacks.

The company added, “For products with higher hardware security requirements, such as hardware crypto wallets, we believe that they should be designed with appropriate countermeasures against EMFI attacks.”

The broader context

Ledger notes that smartphone security discussions typically revolve around malware, remote exploits, or lock-screen bypasses. Phones can be stolen or grabbed by someone. The early boot components, like the boot ROM and preloader, are critical because hacking them gives full device control.

Once these parts are compromised, an attacker essentially owns the phone. Past hardware-level flaws, such as Apple’s checkm8, show how powerful and long-lasting these vulnerabilities can be.

Ledger’s research shows that even modern smartphones, made with advanced silicon, are not secure for storing sensitive cryptographic secrets. Dedicated secure elements are still important for safely handling private keys and other sensitive information. They provide hardware-level protections that regular smartphones cannot supply.

Also Read: solana to Launch SKR Token for Seeker Mobile in January 2026