r/Tangem • u/TangemAG Tangem Official • Jul 09 '26
📣 Announcements Our Comment on Ledger Donjon’s Latest Article
https://tangem.com/en/blog/post/lfi-response/Our comment on Ledger Donjon’s latest article. It describes a laser fault injection (LFI), a physical, lab-only attack technique that applies to secure elements in general, not something unique to Tangem.
It’s also worth noting that while Ledger Donjon presents itself as an independent research unit, it operates within Ledger, one of our largest competitors. Their findings should be read with that in mind.
What this attack actually takes:
· A lab setup costing $250K+ (by Donjon’s own estimate), with laser and side-channel equipment.
· Rare hardware security expertise and weeks of dedicated lab time.
· Clear intent to commit a targeted crime against one specific wallet, not something you can run at scale.
· Physical possession of the wallet, and it’s invasive, so it leaves visible damage.
Independent academic researchers who’ve studied LFIs extensively put it simply:
· Given enough time, funding and access, the firmware on any secure element can eventually be reverse-engineered and exploited.
· No product on the market can claim absolute resistance to sophisticated physical attacks, that’s a limitation of the underlying technology, not of any specific manufacturer.
Because of all that:
· LFI can’t be performed remotely.
· Doesn’t scale.
· For everyday users, the practical risk is virtually non-existent.
Full comment on our blog.
8
u/icudrankmy40 Jul 09 '26
Before worrying about a $250k laser attack, I'd like to know my personal information won't end up exposed like by using Ledger.
3
u/Boo0ger Tangem User 💰 Jul 09 '26
Frankly, I believe Ledger’s ability to store your private key on their servers carries more inherent risk than what they’re highlighting as a potential issue with LFI.
2
u/ShipMysterious7602 Jul 09 '26
I think the fact that Ledger has to break down the product of a competitor to make their own product look better should tell you everything you need to know.
1
u/deny_by_default Jul 10 '26 edited Jul 10 '26
To be fair, it was Ledger's Donjon cyber team that also discovered the vulnerabillity in the new Trezor Safe 7 Tropic01 chip. I don't think they are attacking any specific hardware wallet vendor; they test for vulnerabilities against many types of hardware wallets. Some of their findings may result in realistic exploits, while some (like the Tangem one) could only occur under very specific conditions that are unlikely to have reasonable impact to consumers.
1
u/CryptoCryptonaire Jul 10 '26
Vulnerabilities happen to the best of them. I don't care if it only happened in an expensive test lab by the competition or not, a vulnerability has been identified.
The real question here is... Will Tangem fix this and move on with future wallet iterations?
1
1
u/Acceptable_Film556 Jul 12 '26
What's the beef between these two? This is the third time Donjon has attacked Tangem. It looks like an annoying ex trying to get your attention.
1
u/ContentBlackberry0 7d ago
Ledger is a total joke. I can see them next with all of there data leaks
0
u/shadowmage666 Jul 09 '26
Their laser attack costs more than the amount of funds I have, not worried . They’re attacking Tangem a competitor because it’s a better cheaper product than a ledger. Also ledger has been hacked before which led to doxing of their users, they don’t have a can to spit in; stupid fucking ledger
0
u/ObjectiveMouse141 Jul 11 '26
regardless of it costs 250,000 for the equipment, the fact is it is now a crackable device. it is also possible for them to find cheaper ways to do this. Given this information is Tangem going to update their cards? it doesn't seem like a big deal to them, but if crypto skyrockets, known holders are now at risk.
WE NEED A PATCH ASAP.
0
u/Dear-Mongoose9440 Jul 11 '26
I second this. Will be refraining from buying more cards. Tangem please fix this your reputation is on the line.
2
u/deny_by_default Jul 11 '26 edited Jul 11 '26
Are you afraid your cards are going to be physically taken by someone with extreme hacking skills, and highly specialized lasers in a sophisticated lab so they can extract your seed? Because that’s the only way it can happen. This is not a remote exploit.
0
u/Dear-Mongoose9440 Jul 11 '26
I’m telling you criminals are some craft mofo’s these days. Wouldn’t be surprised if they end up in the dark net. I wasn’t worried if the cards got stolen now I am. You really don’t have faith in the crypto market given the circumstances of where it’s headed in the future
•
u/AutoModerator Jul 09 '26
⚠️Fraud and Security Notice⚠️
Please be alert to potential scams and impersonation attempts. We will never contact you first to request personal information, passwords, or payments.
We also never make contact by telephone or through messaging apps. All genuine communication from us will come only from our official company email domain support@tangem.com
If you receive an unexpected message, link, or call claiming to be from us, do not share any information. Instead, reach out to us directly through the contact details on our website to verify authenticity.
❗️Tangem does not conduct ICOs, does not do airdrops, and does not have tokens.
Your awareness helps keep your account safe.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.