CVE-2026-20435: How a MediaTek Boot Chain Flaw Exposes Crypto Wallets on 25% of Android Phones

TL;DR On March 12, 2026, Ledger's Donjon security team publicly disclosed CVE-2026-20435 — a critical boot chain vulnerability in MediaTek processors that allows an attacker with physical access to extract phone PINs, disk encryption keys, and cryptocurrency seed phrases in under 45 seconds. The flaw affects an estimated quarter of all Android smartphones and impacts popular software wallets including Trust Wallet, Phantom, Rabby, and Kraken Wallet. The Attack: 45 Seconds From USB Cable to Seed Phrase The vulnerability lives in the secure boot mechanism of MediaTek chipsets that use Trustonic's Trusted Execution Environment (TEE). Here's what makes it devastating: No Android boot required. The attacker connects a powered-off device via USB and interacts with the bootloader before the OS even loads. Bypasses TEE protections. The boot chain flaw allows extraction of disk encryption keys directly from the secure enclave — the very component designed to prevent exactly this. Full data acce