Unpatchable MediaTek Chip Flaw Exposes Smartphone Wallets to EM Attacks

Ledger’s Donjon security team has identified a critical, immutable flaw in the MediaTek Dimensity 7300 (MT6878) system-on-chip, a 4-nanometer component found in numerous Android smartphones. The vulnerability resides in the chip’s boot ROM—the foundational code executed during device startup. Because this code is etched into the silicon during manufacturing, it cannot be altered or corrected through software updates, leaving every device built on this platform permanently exposed. This represents a stark limitation in the security model of mass-market consumer electronics.

The exploit methodology is sophisticated yet alarming in its effectiveness. Researchers applied precisely timed electromagnetic pulses during the chip’s initial boot sequence. This fault injection technique allowed them to bypass critical memory-access checks and escalate privileges to EL3, the highest security level in the ARM architecture. From this position, an attacker gains full control over the device. While each individual attempt had a low success rate of 0.1% to 1%, the process took only about a second per try, meaning a full compromise could be achieved within minutes under controlled laboratory conditions.

MediaTek’s response to the findings highlights the core issue. The Taiwan-based chipmaker stated that electromagnetic fault-injection (EMFI) attacks were considered “out of scope” for the MT6878, as it was designed as a consumer-grade component for smartphones, not as a high-security module for financial or sensitive systems. “For products with higher hardware security requirements, such as hardware crypto wallets, we believe that they should be designed with appropriate countermeasures against EMFI attacks,” the company noted in Ledger’s report. This delineation is crucial for understanding the threat landscape.

Ledger’s analysis emphasizes that the security expectations for a smartphone are fundamentally different from those for a device storing private keys. “Smartphones’ threat model, just like any piece of technology that can be lost or stolen, cannot reasonably exclude hardware attacks,” the report states. However, the system-on-chips (SoCs) they use are vulnerable to fault injection, and true security for self-custody of crypto assets must ultimately rely on Secure Elements. These are specialized, tamper-resistant microcontrollers designed specifically to withstand both physical and software-based attacks, creating a hardened environment isolated from a device’s main processor.

This discovery arrives against a backdrop of escalating cryptocurrency theft. A July report by Chainalysis indicated that over $2.17 billion has been stolen from cryptocurrency services in 2025 alone—already surpassing the total for the entirety of 2024. While the majority of these thefts are still perpetrated through phishing and software-based scams, the Ledger report illuminates a growing and sophisticated physical attack vector. It reinforces why hardware wallets, or “cold wallets,” which store private keys offline on a dedicated secure element, are considered the gold standard for protection.

Ledger, a leading manufacturer of hardware wallets like the Nano series, did not explicitly recommend against using smartphone-based software wallets, or “hot wallets.” However, the report’s conclusion is clear: “From malware that users could be tricked into installing on their machines, to fully remote, zero-click exploits… there is simply no way to safely store and use one’s private keys on those devices.” For users engaged in self-custody or handling sensitive cryptographic operations, the company asserts that secure-element chips remain a non-negotiable necessity. The unpatchable MediaTek flaw serves as a potent reminder that the foundation of device security—the silicon itself—must be designed for the threat, a standard consumer smartphone chips do not meet.