Researchers from Ledger Donjon have identified a physical vulnerability in Tangem hardware wallets, which are produced in the form of NFC cards. The attack method is based on laser fault injection, allowing the card's password to be reset and full control over the crypto assets stored on it to be obtained. The issue affects all Tangem models currently in circulation and cannot be fixed, as the devices do not support firmware updates.
Technical Details of the Attack
Inside Tangem cards, a secure element Samsung S3D232A with EAL6+ certification is used, responsible for generating and storing private keys, as well as signing transactions. Access to funds is typically restricted by two factors: physical possession of the card and knowledge of the password. However, as the analysis showed, the logic of the SetPin instruction contains a vulnerability. Using a nanosecond laser pulse directed at a specific area of the chip, the researchers were able to disrupt the recovery state check, forcing the card to accept a new password without entering the old one and without using a backup card.
To carry out the attack, the card must be opened, the secure element exposed, and connected to a specialized hardware platform. After determining the parameters for a specific model, each new exploitation attempt takes about two hours. The cost of equipment for such an attack, according to expert estimates, is around $250,000, and it requires deep knowledge of hardware security.
Tangem's Response and Context
Tangem called the risk for ordinary users "practically non-existent," citing the need for physical access to the card, expensive laboratory equipment, and high expertise. The company also noted that Ledger Donjon is a research division within Ledger—one of Tangem's main competitors—which may influence the interpretation of the results.
It is important to emphasize: EAL6+ certification confirms the chip's resilience but does not guarantee the absence of vulnerabilities in the software logic running on top of it. Researchers recommend that developers implement multiple independent checks for critical operations, more robust state encoding, and enhanced password change protection, even if the recovery function is disabled.
My comment as an analyst: This attack is more of a demonstration of a theoretical possibility than a real threat to the average user. However, it once again raises the question that even the most secure hardware wallets are not absolutely invulnerable, especially when it comes to physical access and invasive methods. For Tangem owners, the main recommendation remains unchanged: never lose the card and do not hand it over to third parties.