demining/pixnapping-attack-on-androidPixnapping Attack: Compromising private keys and seed phrases through vulnerability CVE-2025-48561 represents a new critical threat to the Bitcoin network and Android infrastructure
This article examines the evolution of security threats in the cryptocurrency storage space, focusing on modern methods for compromising private keys and seed phrases, which secure digital wallets. The modern cryptocurrency ecosystem faces a growing threat of cyberattacks aimed at compromising private keys and seed phrases, which are the foundation of digital wallet security. The complexity and sophistication of attacks, exploiting not only the software but also the hardware of modern mobile devices, is increasing every year. Along with traditional threats such as clipboard hijacking, keylogging, QR code spoofing, and exploiting vulnerabilities in BIP32/BIP39 wallet implementations, researchers are increasingly identifying new ways to compromise cryptographic data stored on smartphones.
In early October 2025, researchers from Carnegie Mellon University and several American universities presented the results of a study that caused a stir in the scientific and cryptographic communities. They discovered a critical vulnerability in the Android operating system, dubbed “Pixnapping” and registered under the identifier CVE-2025-48561. This vulnerability allows attackers to reconstruct the screen content of Android devices step by step, thereby extracting sensitive visual information, including private keys, seed phrases , and one-time 2FA authentication codes from apps like Google Authenticator.
The threat identified by researchers relies on the deep interaction between Android’s software and hardware layers—from system APIs to the GPU’s graphics compression engine. Pixnapping combines GPU.zip side-channel techniques with legitimate use of Android Intents and the window blur API, enabling covert pixel-by-pixel reconstruction of the screen. This approach turns a standard smartphone into a source of potential leakage of key information used to manage digital assets, including Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), XRP, and other cryptocurrencies.
The danger lies in the fact that the user doesn’t need to grant the attacker any permissions—the malicious app can run in the background, remaining invisible to the Android security system. As a result, the attacker can gain visual access to seed phrases during wallet backups or withdrawals, effectively equating to complete control over the victim’s crypto assets.
The combination of such threats—from Pixnapping attacks to hardware leaks via Rowhammer, Spectre, Meltdown, and related side-channel methods—highlights the need to rethink security strategies at the intersection of mobile operating systems and financial technologies. Each new vulnerability like CVE-2025-48561 demonstrates how fragile the balance can be between the convenience of mobile access to cryptocurrencies and ensuring fundamental cryptographic security.
Decoded transaction 816760531f334651d711909a93a5959e74b3dbe126f50dbb6efb3e7d61f224ba represents documented evidence of research work, recorded in the immutable ledger of the Bitcoin blockchain. A structural analysis of RawTX reveals the classic architecture of a Bitcoin version 1 transaction, containing a critical element—the OP_RETURN field with an embedded URL pointing to research into the Pixnapping attack.
https://github.com/zoeir/Bitcoin-Message-Transaction
Decomposition of the transaction structure:
The transaction uses a single input (UTXO) from the previous transaction and creates three outputs: the first output, with a value of zero, contains the OP_RETURN message (77 bytes of data), the second output transfers 1000 satoshi (0.00001 BTC) to the recipient address 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr , and the third output returns change of 22,500 satoshi to the sender address 1G84gkhBsBM9B5Xsqw2s9b6H1oqg4nPEiW . The transaction fee is 1000 satoshi, which ensures priority processing by network miners.
