# Laser Attack Defeats Tangem Crypto Wallet Security in Physical-Access Exploit That Can Never Be Patched
Researchers have demonstrated a precisely targeted laser attack capable of resetting passwords on Tangem hardware wallet cards, granting attackers complete control of the device without requiring the original password, recovery card, or any backup access method. The flaw affects every card ever produced and cannot be fixed through software updates.
## The Threat
A team at Ledger's Donjon security lab has successfully weaponized a laser-based attack against Tangem's popular hardware wallet cards, proving that an attacker with physical possession of a card can completely compromise it by forcing a password reset. The implications are stark: once an attacker gains access to your card, they can drain your cryptocurrency holdings.
However, the attack is not as straightforward as it might sound. It requires expensive laboratory equipment, specialized knowledge, destructive physical modification of the card, and approximately two hours per target to execute successfully.
## Background: Tangem's Design Philosophy
Tangem markets its hardware wallets as sleek, credit-card-sized devices that securely store cryptocurrency private keys. The company positions its products as the most portable and user-friendly alternative to larger hardware wallets like Ledger Nano or Trezor devices.
Key features Tangem emphasizes:
This last point—the inability to update firmware—is central to understanding why this vulnerability cannot be fixed. Tangem intentionally designed its cards with immutable firmware, arguing that an unchangeable system cannot be remotely compromised. That philosophical position now creates a permanent liability.
## How the Attack Works
The laser exploit takes advantage of a critical gap in Tangem's password reset mechanism. The card supports a recovery feature that allows owners to reset forgotten passwords by bringing two linked cards together. During this recovery process, the card performs a single security check: Is this card in recovery mode?
If the answer is yes, the card accepts a new password without requiring the original password. This is convenient for legitimate users but creates an opening for attackers.
The attack sequence:
1. Laser targeting: Attackers use a precision laser to fire at the Samsung S3D232A chip at a microsecond-level timing window
2. Fault injection: The laser pulse briefly disrupts the chip's circuitry, causing the recovery-mode check to malfunction
3. False positive: The chip incorrectly behaves as if it is in recovery mode
4. Password reset: With the check bypassed, the attacker uses the standard SetPin command to install a new password—no old password needed, no second card required
5. Full compromise: The attacker now controls the wallet and can withdraw all funds
The researchers reported working with the attack for approximately two hours per card once the initial setup was complete, after months of preparation to map the chip, identify the precise laser spot, and calibrate the timing.
## Technical Details: Why This Is So Difficult (But Possible)
The laser attack represents sophisticated hardware security research, but it is not a theoretical attack—Donjon confirmed it worked consistently against every test card.
Requirements for execution:
Why this is physically invasive:
Unlike remote attacks that can be deployed at scale, this method requires the attacker to have the specific card in a laboratory setting. The card must be surgically opened to expose the chip, rendering it visibly damaged and non-functional as a wallet afterward.
This invasiveness creates a significant obstacle: an attacker has no way to know whether a stolen or lost card holds $100 or $100,000 before spending $250,000 and destroying multiple cards to perform the attack.
## Implications: Who Is Truly at Risk?
The vulnerability creates a narrow but meaningful risk profile:
High-risk scenarios:
Lower-risk scenarios:
The $250,000 equipment cost means this attack is not a concern for average users or petty criminals. However, for a high-value target with a stolen Tangem card, the attack becomes economically rational—especially if the attacker knows the card contains significant value.
## Tangem's Response: Contradictions and Context
Tangem has pushed back against the severity assessment, making several points:
Tangem's arguments:
Where Tangem is correct:
Where Tangem misses the mark:
## What Users Should Do
Immediate steps for Tangem owners:
1. Assess your holdings: If your card holds significant value (particularly anything with real financial consequences if lost), evaluate the risk profile
2. Secure your cards: Keep physical cards in safe storage, preferably not carried daily
3. Consider alternatives: If your card is lost or stolen, replace it with a firmware-updatable hardware wallet that can receive security patches
4. Monitor for exploitation: Watch for any evidence of laser-based attacks in the wild (currently none reported)
5. Diversify custody: For high-value holdings, split assets across multiple secure devices with different security architectures
For institutional users:
## HackWire Analysis
The laser attack exposes a fundamental paradox in hardware wallet security: immutability marketed as a feature becomes a permanent liability when flaws are discovered.
While Tangem argues that unchangeable firmware prevents remote attacks, this philosophy creates a one-way asymmetry. Legitimate users benefit from permanence (no surprise updates breaking compatibility), but attackers enjoy the same advantage—flaws persist forever. Competitors like Ledger and Trezor can patch vulnerabilities; Tangem cannot.
The $250,000 cost barrier also reveals a hidden market dynamic. The attack only makes financial sense if the attacker knows the card holds substantial value—yet crypto cards are anonymous. An attacker cannot inspect a stolen Tangem to assess worth before committing laboratory time and equipment costs. This economic friction may protect most users more effectively than the technical barriers do. A thief with a stolen card faces a gamble, not a sure theft.
The broader lesson: secure-element chips are only as good as the firmware that controls them. Fault injection attacks against secure elements are well-established in academic literature; Donjon's contribution is proving that a common commercial implementation is vulnerable to a timing-based variant. Other wallet manufacturers should audit their own password-reset logic and recovery mechanisms for similar weaknesses.
For defenders, this incident highlights why firmware updatability—once seen as a security liability—has become a necessity. The ability to patch flaws outweighs the theoretical risk of supply-chain compromise. Tangem's commitment to immutability was a design choice that made sense in an earlier era of hardware security thinking. That era has ended.
Most Tangem users face minimal practical risk. But anyone whose card has been lost, stolen, or handled by untrusted parties should strongly consider migrating to a hardware wallet architecture that supports security updates. The gap between "lab curiosity" and "proven attack in the wild" can close quickly once weaponized techniques become public.
— HackWire Editorial
## Recommendations for Defenders
## Related Coverage