Ledger Finds Popular Smartphone Chip Vulnerable to Unpatchable Attacks – Decrypt

An unpatchable flaw in a broadly used smartphone chip developed by Taiwan-based MediaTek allowed researchers to take full management of the system by way of a exactly timed electromagnetic assault, in keeping with new findings printed on Wednesday by crypto pockets supplier Ledger.

The susceptible code sits within the chip’s boot ROM, the earliest stage of the startup course of, that means it can’t be corrected with a software program replace.

Ledger’s Donjon workforce examined the MediaTek Dimensity 7300 (MT6878), a 4-nanometer system-on-chip discovered in lots of Android telephones.

By making use of rigorously timed electromagnetic pulses throughout the chip’s preliminary boot sequence, the researchers have been capable of bypass memory-access checks and escalate into EL3, the best privilege stage within the ARM structure.



“From malware that customers could possibly be tricked into putting in on their machines, to totally distant, zero-click exploits generally utilized by government-backed entities, there may be merely no solution to safely retailer and use one’s non-public keys on these units,” they wrote.

The report comes at a time when assaults focusing on cryptocurrency holders are on the rise.

A July report by Chainalysis mentioned over $2.17 billion has been stolen from cryptocurrency companies thus far in 2025; greater than the whole lot of 2024.

Whereas bodily assaults are rising, nearly all of crypto-related thefts are perpetrated by hackers by way of phishing assaults or scams.

As soon as they recognized the exact timing window, every try by the Donjon workforce took a few second and had successful price of 0.1%-1%, permitting a full compromise inside minutes underneath lab circumstances.

Whereas Ledger is greatest identified for its common Nano {hardware} wallets, it didn’t outright say to not use smartphone-based wallets. The report suggests a brand new risk vector focusing on software program builders and customers.

Ledger didn’t instantly reply to requests for remark by Decrypt.

{Hardware} and software program crypto wallets

A cryptocurrency pockets is software program that shops a person’s private and non-private keys and lets them ship, obtain, and monitor digital property.

{Hardware} wallets or “chilly wallets” go a step additional by maintaining these non-public keys offline on a separate bodily system, indifferent from the web and shielded from assaults that may attain telephones or computer systems.

Software program wallets or “scorching wallets” are apps that permit customers to retailer their digital property on a wide range of units, however go away the person open to hacks and phishing assaults.

MediaTek, in a press release included in Ledger’s report, mentioned electromagnetic fault-injection assaults have been “out of scope” for the MT6878 as a result of the chipset was designed as a consumer-grade element fairly than as a high-security module for monetary or delicate methods.

“For merchandise with increased {hardware} safety necessities, comparable to {hardware} crypto wallets, we consider that they need to be designed with applicable countermeasures towards EMFI assaults,” they wrote.

Ledger mentioned units constructed on the MT6878 stay uncovered as a result of the flaw resides in unchangeable silicon.

Safe-element chips, the corporate added, stay obligatory for customers who depend on self-custody or deal with different delicate cryptographic operations, since these parts are designed particularly to resist each {hardware} and software program assaults.

“Smartphones’ risk mannequin, identical to any piece of know-how that may be misplaced or stolen, can’t fairly exclude {hardware} assaults,” Ledger wrote. “However the SoCs they use aren’t any extra exempt from the consequences of fault injection than microcontrollers are, and safety ought to actually finally depend on Safe Components, particularly for self-custody.”