Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched
Laser Attack Resets Tangem Wallet Passwords
Researchers at Ledger’s Donjon security team have demonstrated a serious vulnerability in Tangem crypto wallet cards. A precisely timed laser pulse aimed at the chip inside a Tangem card can reset the card’s password to any value the attacker chooses. This means that once reset, the attacker gains full control over the wallet and can transfer the funds out without needing the old password or a backup card.
This attack is not an immediate threat for most users, as it requires the physical card and specialized equipment costing around $250,000. Additionally, the card must be cut open, leaving visible damage. Importantly, this method cannot be executed remotely, and there is no software fix available since Tangem cards cannot receive updates. Therefore, anyone who has lost or had their card stolen and holds significant value should take action now! 🚨
A Tangem wallet resembles a standard bank card and contains the secret key to your crypto assets. The vulnerability lies in the password reset feature, which allows users to set a new password by holding two cards together. If an attacker fires a laser pulse at the chip during this process, it disrupts the chip’s circuitry, tricking it into accepting a new password without the old one.
While this attack requires advanced skills and equipment, Donjon’s findings are alarming. They reported the flaw to Tangem on February 10, 2026. The issue is compounded by the fact that Tangem cards cannot be updated, leaving a permanent vulnerability. Tangem has responded, stating that no one has lost funds to such an attack yet, and for most users, the risk remains low.
In a related incident, Donjon also used this technique on the TROPIC01 chip in the new Trezor Safe 7, prompting Trezor to implement a stopgap solution for current chips. For users, the best defense is to keep their cards secure and to act quickly if their Tangem card is lost or stolen.
Stay safe and protect your assets! 💼