Tangem Wallet Hacked? The Truth Behind 0 Cards Compromised and the $250,000 Laser Attack

We went digging into whether a Tangem wallet has ever been hacked, expecting either a shrug or a scare story. What we found was both weirder and more interesting: no Tangem wallet has ever been hacked in the wild, but a competing vendor’s security lab demonstrated a real, reproducible lab attack that cracks a card open with a single laser pulse. Both things are true at the same time, and headlines keep smashing them together. Tangem says it has produced over 1,000,000 cards with zero hacked, which is a vendor-reported stat, not an independent audit finding.

Meanwhile, Ledger Donjon, the security research arm of Tangem’s biggest rival, privately notified Tangem on February 10, 2026 that it could fault the recovery-state check inside the card’s SetPin handler with one nanosecond laser pulse and set the password to whatever it wanted. So here’s the honest three-tier answer: the field-hack tier is empty (no documented victim has ever lost funds this way), the lab-attack tier is proven (100% reproduction across three cards), and the vendor-stat tier sits unverified in between. Only one of those tiers is independently verified, and it’s not the reassuring one. What actually matters for your pocket isn’t the laser at all. It’s whether you lose the card.

Has a Tangem wallet ever been hacked in the real world?

No Tangem wallet has ever been hacked in the real world, a proven lab attack does exist, and zero documented victims have lost funds to either one. Those are three different claims, and only the second is independently verified. The zero-hacked record is Tangem’s own claim about its million-plus cards. The lab attack is Ledger Donjon’s published, reproducible work. The victim count of zero comes from, well, the absence of anyone.

Tangem’s rebuttal lines up with how crypto actually gets stolen: mistyped recovery phrases, malicious applications, fraudulent contracts, and careless approvals, not decapping lasers. Its marketing stack, including an encrypted app vault tied to phone secure hardware and a screenless battery-free card, is vendor framing. That’s a different animal from what auditors found, and we’re keeping the two separate on purpose.

How the Ledger Donjon laser fault injection attack actually works

One nanosecond laser pulse faults the recovery-state conditional check inside the SetPin handler on the card’s EAL6+ Samsung S3D232A chip, and the card then accepts an attacker-chosen password. Ledger Donjon reproduced it with 100% success across three cards. That’s the whole vulnerability: a single bad branch check. Genuinely clever-horrifying.

The recovery design the attack abuses

Tangem wallets come as two- or three-card packs sharing one master key, and recovery between onboarded cards is on by default, using a challenge-response handshake so one card can reset the other’s password. SetPin imposes no delay or lockout, so attempts are unlimited and rapid. That design is great UX until you look at the code path it creates.

The mechanism

The attack works without the old password, without a backup card, and even with recovery disabled, because disabling recovery only gates the Authorize instruction. The recovery branch inside SetPin stays reachable either way. After the reset, the attacker signs arbitrary transactions and drains everything on the card.

One footnote this readership will check: the chip is the Samsung S3D232A per Ledger Donjon’s and SQ Magazine’s technical teardowns, though some wallet reviews list the S3D350A. We’re going with the teardowns, because part numbers matter.

Inside the lab: how researchers defeated the EAL6+ chip’s countermeasures

The countermeasures mostly worked as designed, and an FPGA power-tearing rig turned the chip’s own fault counter into the attack’s solved bottleneck. The card was soldered to a custom Scaffold daughterboard with an impedance-matched antenna and fed external DC power, about 5x faster than the 13.56 MHz inductive NFC field, while a Langer EMV ICR probe found the timing window where legitimate and unauthorized SetPin traces diverge. Flash and RAM resisted faults, likely thanks to error-correcting codes, and the responsive region answered with status word 6A86. The coolest physics fact here deserves its landing: the AlphaNov laser fires nanosecond pulses through the die’s backside, because silicon is transparent to the right wavelength. Blind brute force is infeasible without that characterization, and roughly 256 perturbation events would brick a card, until the FPGA cut power at flash-write start and stretched card life from minutes to over a day.

Attack economics: who could actually drain a Tangem card

Yes, someone with your lost Tangem card and access to a roughly $250,000 lab could drain it in about two hours. No one without both has ever done so. The requirements are physical access to one card, that quarter-million-dollar bench, advanced hardware and software security expertise, and extensive chip characterization. The attack is invasive, visibly damages the card, and has no covert version.

The asymmetry is the story. The fixed cost is prohibitive: about an hour of narrowed scanning before the first success. But once the parameters are mapped, it’s roughly 2 hours per card at 100% success, which puts this within reach of universities and security labs, not individuals. The realistic threat is a sophisticated actor holding your lost card, not a hacker on the internet. And yes, the $2 card versus a quarter-million-dollar bench is the funniest honest comparison available.

Unpatchable vulnerability: the firmware-lock trade-off

There’s no firmware update mechanism, so the flaw is permanent in every card ever sold, and a fix requires a chip redesign. The mitigations Ledger Donjon recommended (redundant state checks, fault-resistant boolean encoding with large Hamming distances, and validating recovery inside SetPin) apply only to future designs. Here’s the tension worth sitting with: Tangem markets the permanent lock as eliminating supply-chain and firmware attacks, and Donjon shows the same lock guarantees this flaw ships forever. One design decision, two legitimate truths.

What Tangem’s audits and EAL6+ certification actually covered

EAL6+ certification is not a security guarantee. It certifies the silicon, not the software written for it, and it doesn’t promise fault-injection immunity.

What the audits found

Riscure went through the source code, the architecture, and everything reachable over NFC, and found no private-key exposure, no exploitable backdoors, and verified side-channel risk minimization with optional encryption of data in transit. They genuinely pulled the thing apart. Kudelski Security did the first firmware audit back in August 2018, which is worth naming honestly because audits age. Neither audit covered physical fault injection, because that’s not what audits of this type test.

What the certification means

Common Criteria runs an EAL1 through EAL7 scale under ISO/IEC 15408 that measures evaluation rigor, not invincibility. Consumer secure elements typically land at EAL5-EAL6, and EAL6+ is biometric-passport class. The kicker: that certified Samsung chip faithfully executed flawed closed-source firmware, and one conditional check did all the damage. Certification answers “is the silicon trustworthy.”

The failure lived in the code running on it. Because nobody outside the vendor can inspect that firmware, flaws tend to surface through adversarial black-box work rather than community review. That is the concrete, verifiable shape of the supply-chain concern you’ll see discussed, not an accusation of anything. The pattern among buyers is treating an audit as covering every attack class without checking which surfaces it actually tested.

Tangem’s response and the disclosure timeline

The unpatchable flaw is not, by itself, a reason to stop using the wallet. It does change how you treat a missing card.

The timeline: Ledger Donjon privately notified Tangem on February 10, 2026, and the public report followed roughly five months later. That window fits disclosure norms. But disclosure norms assume a fix is coming, and there is no fix coming here. Every card sold during that window shipped permanently vulnerable, and every card ever sold stays that way until the silicon changes. Both facts are true, and neither cancels the other.

Now the steelman, because this audience hates strawmen. Tangem’s rebuttal holds that the attack doesn’t scale, requires a highly skilled lab operator, destroys cards during characterization, and that no losses attributable to laser fault injection have ever been documented. The honest caveat on “not scalable”: it’s true today, and skilled-operator attacks have historically gotten easier over time, though that’s a trend line, not a forecast. A third-party assessment found the rebuttal consistent with Donjon’s published numbers, which is about as clean as vendor-lab disputes get.

Tangem’s marketing claims deserve their own label, separate from all of the above. Per the vendor: the app stores access codes in an encrypted vault tied to the phone’s secure hardware, blocks overlay and accessibility attacks, blocks custom keyboards on sensitive entry and screenshots, and the screenless battery-free card eliminates supply-chain and firmware attack classes. There’s an irony here we’ll note without a gotcha: the laser attack arrived through the neighbor of that “no firmware attack” surface.

Post-disclosure community discussion has been reaction and debate. The sources contain no documented incident reports, and we won’t invent forum threads or quotes to fill that gap. Beyond the anecdotes, you can form your own view of the post-purchase experience from Tangem’s Trustpilot rating, while our hands-on Tangem wallet review covers the hardware and app experience.

Coldcard vs Tangem: the scarier attack has the cleaner record

The wallet with the scarier-sounding attack has the cleaner record. In 2026, a Coldcard firmware-randomness hack drained roughly 1,816 BTC, about $116 million, from over 5,200 addresses starting July 30, 2026, via a flaw present since March 2021. No hardware hack of any unit involved. The mechanics were almost boring: a software PRNG fallback seeded with just the device UID and power-on timer, so keys could be reconstructed entirely offline. Coinkite’s framing, reported as their statement, is that devices weren’t hacked or remotely accessed; the flaw was in generation, not operation, and the fix protects only future seed generation.

Here’s the plain sentence nobody says: headlines track attack theatrics, but losses track software flaws and user error. $116 million through boring randomness. Zero victims through a $250,000 laser. We’re not equating the two incidents technically, and Coldcard victims have nothing to do with Tangem.

How other hardware wallets handle the risks Tangem can’t patch

On the Tangem-vs-Ledger question: there’s no clean winner. Ledger’s hardware has held, but its corporate and data history differs, and Ledger’s own Donjon lab found the Tangem flaw. Beyond that, no single architecture is complete. Shift Crypto found no conclusive evidence that air-gapping is inherently more secure; it trades online attack vectors for operational complexity, malicious QR payloads, compromised microSDs, and user error. Judge by threat model, and treat coin support and device compatibility as threshold requirements before spec differences.

Trezor Safe 7

The first mainstream wallet with two secure elements, one fully open to audit (Tropic Square’s TROPIC01) plus a separately certified EAL6+ chip. Each enforces attempt limits and carries voltage, temperature, and laser tamper sensors that wipe secrets, which is directly relevant given the Donjon attack, though sensors don’t guarantee immunity. There’s a quantum-ready bootloader and BLE with a hardware kill switch. About $249. It’s the most direct answer to the certification-versus-verifiability question.

Ledger Stax and Flex

The EAL6+ ST33K1M5 secure element drives the E Ink display directly, which is genuinely unusual architecture and worth a “huh, neat.” BOLOS sandboxing, open-source companion apps, Bluetooth 5.2, and the Nano X runs an EAL5+ ST33J2M0. The irony stands: Ledger’s own lab broke the Tangem card.

Ledger’s record

Its customer database was exposed twice, fueling phishing against known large holders, and Ledger Recover raises privacy concerns. Yet there’s no documented remote drain of a Ledger secure element, and the company has been the commercial volume leader since 2014. Hardware clean, corporate history messy. Don’t flatten that.

BitBox02 Nova

An open-source microcontroller plus a separately certified OPTIGA Trust M V3 (EAL6+), and neither chip alone compromises the wallet, which is the whole point of the split. microSD backup with optional on-device 24-word BIP-39 display, BLE and Whisper support for iPhone and iPad, and a Bitcoin-only edition with a smaller codebase. No major breach reported as of early 2026, phrased exactly as absence of evidence.

Keystone 3 Pro

Three secure elements with split roles: an ATECC608B for the recovery phrase, a Maxim DS28S60 for the seed, and a Maxim MAX32520 for the fingerprint. Fully air-gapped via QR and microSD only, and it has PCI-level anti-tamper self-destruct, which is real and objectively delightful in a movie-prop way. SlowMist-audited open firmware, 100g, a four-inch touchscreen, about $149, and two-scan QR signing supports MetaMask and DeFi.

Ellipal Titan 2.0

No Wi-Fi, Bluetooth, cellular, NFC, or USB data. Read that list out loud; it’s the point. EAL5+ secure element, on-device recovery-phrase generation, anti-tamper wipe, microSD updates, about $149, with over 1 million users across 140+ countries. The honest caveat: the key-generation firmware isn’t auditable, so you’re trusting the vendor, the same closed-source trust requirement Tangem carries.

Multisig via Casa and Unchained

Casa offers 2-of-3 at $21/month or $250/year, plus a 5-key Premium tier. Unchained uses 3 keys with 2 to spend: you hold two, Unchained holds one, and it can’t move funds unilaterally. The core win is that one compromised key can’t move funds alone, which directly neutralizes the lost-card scenario. The trade-offs are setup complexity and subscription cost.

Trezor Model One and Model T

General-purpose microcontrollers rather than dedicated secure elements: everything’s auditable, nothing’s armored. Physical data extraction is possible under lab conditions unless a strong passphrase is configured, and KeepKey inherits the same vectors from copying the original design. Texture beat: Trezor was founded in 2013 in Prague by Marek Palatinus and Pavol Rusnak, the original hardware wallet.

Trezor Safe 3

Dual-chip: open-source firmware microcontroller plus a dedicated secure element. The Safe-line vulnerability surfaced, no keys, PIN, or backup were compromised, and firmware updates were deployed. Notice how that story ends versus Tangem’s. Found flaw, shipped patch, moved on.

Coldcard MK2/MK3

The MK2 paired a secure element with a microcontroller, an early version of the split design everyone uses now, and fell to PIN brute-force with specialized hardware. The MK3 fixed it, and PSBT files ride microSD cards for air-gapped signing. Vulnerability found, fix shipped, product iterated: the healthy lifecycle Tangem’s design forecloses.

NGRAVE ZERO and GRAPHENE

The premium-maximalist corner: an EAL5+ STMicroelectronics AFEA100, fully air-gapped QR only, $398, paired with GRAPHENE, a fire- and water-resistant metal backup.

Steel seed backups and passphrases

The least glamorous and most practical item here. Steel resists fire and water where paper doesn’t, typical assembly runs under 30 minutes around the 24-word phrase, and pairing with a passphrase means the backup alone can’t unlock the full balance. Caveat: passphrases can be lost too.

Sober verdict: who should worry about a hacked Tangem, and what to do now

The honest bottom line: the $250,000 laser attack is real, proven, and unpatchable, but it has never cost anyone a cent, because no one without physical access to your card can use it. That makes this less a hacking story and more a custody story. Here’s who should actually worry, and what to do about it.

If your card is lost or stolen

Move your funds immediately. Treat it like a missing wallet, because functionally it is one now. The attack is physical, invasive, and non-covert, so the only realistic exposure is a missing card in sophisticated hands. A card in your possession cannot be remotely exploited.

The pattern we see is owners reading a lab-attack headline and panic-replacing perfectly good cards, while never thinking about the lost-card scenario that’s the actual risk. For the security model in more depth, see our breakdown of how safe a Tangem wallet really is.

Should you buy Tangem in 2026?

Every new card ships with the same unpatchable property. Pricing runs $54.90 for the two-card pack and $69.90 for the three-card pack (one review lists $69 flat, likely rounding; prices may vary). So, are Tangem wallets safe? Safe from remote attack, yes, flatly, with the lost-card caveat attached.

Panic-replacing is unjustified at a $250,000 attack cost. Switch to multisig or another architecture only if targeted physical attack is genuinely in your threat model. The correct response here is a physical-custody rule, not a wallet purchase decision.

People Also Ask