Android flagship chips compromised: Can we still trust mobile hot wallets?

[BlockBeats] Recently, a certain hardware wallet team made big news—they discovered a vulnerability in a widely used processor chip found in Android phones that could allow attackers to tamper with the device. Simply put, if you only use a software wallet on your phone to store crypto, and someone gets physical access to your device, you could be in serious trouble.

The issue this time is with the MediaTek Dimensity 7300 chip manufactured by TSMC. The security team used a hardcore method—injecting electromagnetic pulses into the chip via open-source tools, forcibly disrupting its boot process. They found that the chip’s boot ROM had flaws that could be exploited to precisely capture its runtime data. Even more impressively, they managed to bypass the chip’s write protection mechanism and directly overwrite the return address, ultimately running their own code at EL3, the processor’s highest privilege level. The whole attack process? It can be reproduced in just a few minutes.

While this doesn’t affect the security of dedicated hardware wallets, it’s a harsh wake-up call for those who rely solely on hot wallets on their phones to store assets. After all, if even top-tier mobile chips can’t withstand physical attacks, it’s much safer to keep your private keys on a dedicated device with a secure chip. MediaTek was notified back in May, and affected manufacturers are likely busy rolling out patches now.