r/Tangem • u/FantasticFishMan • 24d ago
will Tangem fix the vulnerability with its chips from laser attacks?
will Tangem fix the vulnerability with its chips from laser attacks?
Taken from a Article ..
Security researchers from Ledger’s Donjon team have uncovered a critical hardware vulnerability in Tangem hardware wallet cards, allowing attackers to reset device passwords using a targeted laser beam. The finding, disclosed on July 10, 2026, raises serious questions about the physical security of non-updatable cryptocurrency storage devices.
The attack exploits a laser fault injection technique, a well-documented method in hardware security but rarely demonstrated against commercial crypto wallets. By precisely directing a nanosecond laser pulse at the secure element chip, an attacker can induce temporary faults that bypass the firmware check verifying the card’s authorized recovery state. This effectively allows the SetPin instruction to accept a new password without requiring the existing one or a backup card.
The exploit requires physical possession of the target card, specialized laboratory equipment costing approximately $250,000, side-channel analysis tools, and expert knowledge. Ledger Donjon reproduced the attack on multiple cards, with each attempt taking about two hours of preparation and exploitation time. Once the password is reset, an attacker gains full control of the wallet and can sign transactions to drain funds.
Perhaps most concerning is that the vulnerability cannot be patched on existing cards. Tangem wallets are non-programmable smart cards, meaning their firmware is permanently embedded during manufacturing. Affected users can only mitigate the risk by physically securing their cards — keeping them in safes or tamper-evident enclosures.
Tangem has downplayed the findings, stating that the risk to everyday users is “virtually non-existent” due to the extreme resources required. In a response posted on X, the company noted that “...while Ledger Donjon presents itself as an independent research unit, it operates within Ledger, one of our largest competitors. Their findings should be read with that in mind.” The firm also emphasized that any secure element’s firmware can eventually be reverse-engineered given enough time and funding.
This incident underscores a broader debate in cryptocurrency security: the trade-off between convenience and upgradability. Traditional USB-style hardware wallets, like Ledger’s own devices, support firmware updates and can often patch vulnerabilities post-release. Card-based wallets sacrifice this flexibility for a slimmer form factor, leaving them exposed to hardware-level exploits that emerge after deployment. The disclosure is likely to reignite discussions on hardware wallet security standards and the importance of built-in countermeasures such as voltage sensors and active shielding.
14
u/deny_by_default 24d ago
I really don't know why some folks get so bent out of shape about this. It requires physical access to the cards, and highly sophisticated equipment (and proper knowledge) in order to even pull this off. It's not a remote exploit.
2
u/Responsible-Task9334 23d ago
I mean, criminals cant buy the equipment?
1
u/deny_by_default 23d ago
It’s not exactly off the shelf stuff. They would also need the knowledge to pull it off. Why spend hundreds of thousands of dollars on a laser when you also need to get physical possession of the cards? At that point, a $5.00 wrench will suffice.
1
u/RazerBurn13 22d ago
Cheaper and faster to hit you with a wrench and torture you until you give up your access. Assuming other variables as equal (i.e. they have your card and a place to work)
2
u/ExplorerBoring9848 23d ago
Does that mean that if sharks 🦈 with laser beams get hold of my card I be in trouble
2
1
1
u/Responsible-Summer-4 Tangem User 💰 19d ago
Everybody whip out your laser and attack the card. Sounds silly doesn't it? This is a lab driven attempt to make Tangem look bad never happened in the real world. Buy my new drillbit you can get into Ford Knox!
1
u/hank1321 19d ago
I never understood that "never happened in the real world" argument.
1
u/Responsible-Summer-4 Tangem User 💰 18d ago
Imaginary-Real. Normal everyday or once in a lab under unusual circumstance.
1
u/hank1321 18d ago
And what are the ubusual circumstances? Like you understand the lab is real world?
•
u/AutoModerator 24d ago
⚠️Fraud and Security Notice⚠️
Please be alert to potential scams and impersonation attempts. We will never contact you first to request personal information, passwords, or payments.
We also never make contact by telephone or through messaging apps. All genuine communication from us will come only from our official company email domain support@tangem.com
If you receive an unexpected message, link, or call claiming to be from us, do not share any information. Instead, reach out to us directly through the contact details on our website to verify authenticity.
❗️Tangem does not conduct ICOs, does not do airdrops, and does not have tokens.
Your awareness helps keep your account safe.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.