Ledger’s Donjon security team has disclosed a hardware attack that can reset the password on a Tangem wallet card.
Summary
- Ledger researchers reset Tangem card passwords using a targeted laser pulse against secure element firmware.
- The attack requires physical possession, specialist skills, invasive preparation and laboratory equipment costing around $250,000.
- Tangem called everyday risk virtually nonexistent but advised users to keep their wallet cards physically secure.
The method could allow an attacker to sign transactions and move funds linked to the card.
However, the attack requires physical possession of the wallet, specialist knowledge and laboratory equipment worth about $250,000. Tangem said those conditions make the risk to ordinary users “virtually non-existent.”
Laser attack bypasses Tangem password check
According to Ledger Donjon’s technical report, researchers used a nanosecond laser pulse against a specific area of the card’s secure element. The pulse disrupted a check inside Tangem’s firmware during a password reset command.
Tangem cards normally require the current password before accepting a new one. A recovery process can also reset the password when a user has another backup card linked to the same wallet.
The researchers said their attack bypassed the check that confirms whether the card had entered an approved recovery state. This allowed them to set a new password without knowing the original password or holding a backup card.
Ledger Donjon repeated the process on three cards. After the initial research, each test reportedly took about two hours to prepare and complete. The team disclosed the flaw to Tangem on Feb. 10.
Current Tangem cards cannot receive a patch
Ledger said the issue affects Tangem cards currently in circulation. The cards do not support firmware updates, meaning Tangem cannot distribute a software patch to devices already held by customers.
To perform the attack, researchers cut open the plastic card and removed shielding to expose the chip. They then rewired the device to custom equipment before carrying out power analysis and laser fault injection.
The invasive preparation damages the physical card. Ledger Donjon said an attacker could not secretly perform the procedure and return the card in its original condition.
“What this means for users: there’s no patch, but the attack is physical and invasive,” the researchers said. They added that the main risk applies when a card becomes lost or stolen.
Tangem disputes practical risk to users
In its response on X, Tangem did not dispute that the laboratory team completed the attack. However, it questioned whether the findings represent a practical threat to customers.
Tangem said the method needs “physical possession of the card, expensive laboratory equipment, and highly specialized expertise.” It described the everyday risk as “virtually non-existent.”
The company also noted that Ledger Donjon operates within Ledger, one of Tangem’s main hardware wallet competitors. Tangem said readers should consider that commercial relationship when assessing the report.
Still, Ledger’s researchers said the issue shows that an EAL6+ certified secure element does not protect against every attack. The certification covers the chip’s resistance to physical threats, but security also depends on the firmware running inside it.
Physical control remains the main safeguard
The disclosed attack does not work remotely. An attacker cannot use it through the Tangem mobile app, an internet connection or an NFC interaction alone.
Tangem users can reduce exposure by keeping every card secure and treating a lost card as a security event. Moving funds to a new wallet would remove the risk linked to a missing device.
The finding follows earlier research into Tangem’s security. Ledger Donjon previously disclosed an Android genuine-check bypass and a separate brute-force method targeting the card’s authentication process.
As reported by crypto.news, Ledger researchers also found a MediaTek chip flaw that could expose passwords and wallet data on some Android devices. Unlike the Tangem card attack, MediaTek later issued a patch for the affected mobile chips.
The latest Tangem finding remains limited by cost, access and technical difficulty. However, users whose cards remain in their possession are not exposed to the physical attack described by Ledger Donjon.
