Researchers at Ledger’s Donjon security team have shown that a precisely timed laser pulse, aimed at the chip inside a Tangem crypto wallet card, can reset the card’s password to anything the attacker picks.
No old password. No backup card. Once it is reset, whoever did it controls the wallet and can move the coins out.
This is not an emergency for most owners. The attack needs the physical card in hand and a lab that Donjon puts at around $250,000. It also means cutting the card open, which leaves damage no one can miss. It cannot be done over the internet, and there is no fix coming: Tangem cards cannot take software updates, so every card already sold carries the flaw.
The one group that should act now is anyone whose card is lost or stolen and holds serious value.
How the card is meant to protect you
A Tangem wallet looks like a plain bank card. Tap it to your phone, and a companion app talks to a Samsung S3D232A chip inside. That chip is a secure element, built to resist tampering and certified to a high grade called EAL6+.
It holds the secret key that controls your crypto and never lets it out. Two things are meant to stand between a thief and your money: holding the card and knowing the password.
The weak point is the password reset feature. Tangem sells its cards in linked sets, and if you forget your password, you can set a new one by holding two of your cards together. Deep inside that process, the card runs a single check: is this card in recovery mode? If yes, it accepts a new password without asking for the old one.
A laser pulse fired at the chip at the exact moment it runs that check does not quietly rewrite a stored value. It briefly disturbs the chip’s own circuitry, so the check misfires and the card behaves as if it were in recovery mode when it is not.
With the check defeated, the card’s ordinary SetPin command accepts a brand-new password: no old password, no second card, no recovery step. Turning the recovery feature off does not help, because the same check still runs on every card.
Hard to do, and unfixable
None of this is easy. It took a laser rig, sensitive measuring gear, deep hardware skill, and a long stretch of up-front work to map the chip and find the exact spot and timing. The card has to be cut open and its chip exposed, which leaves obvious damage.
There is no doing this quietly and slipping the card back into a pocket. Donjon reports that once the settings were locked in, the attack worked on every card it tried, at about two hours each. The team reported the flaw to Tangem on February 10, 2026.
The bigger problem is permanence. Tangem builds its cards with no way to update the firmware, and presents that as a security feature: nothing can be changed, so nothing can be tampered with from a distance. Here, that same design cuts the other way, leaving a flaw in the code that can never be corrected.
As the researchers put it, “there’s no patch, but the attack is physical and invasive”, so it cannot be done remotely.
What Tangem says
Tangem pushed back. In a public response, the company called this a lab-only physical method that works against secure element chips in general, not something unique to its cards. It also noted that Donjon belongs to Ledger, one of its biggest rivals.
Its sharpest point is about money: a Tangem card carries nothing that says who owns it or how much it holds, so an attacker who spends $250,000 and wrecks cards to tune the attack has no way to tell whether a stolen card is worth $50 or $50 million. Tangem also says no one has lost funds to a laser attack on any hardware wallet so far, and that for everyday users, “the practical risk is virtually non-existent.”
Both sides are partly right. Donjon researchers are right that the flaw is real, sits in every card, and can never be patched. Tangem is right that for almost everyone, the cost, the ruined cards, and the guesswork over what a card holds make it pointless.
The place they actually meet is narrow: a lost, stolen, or seized card that an attacker already has reason to think is worth the trouble.
Not the first wallet chip broken this way
This is not Donjon’s only laser attack on a hardware wallet this year. In early June, Trezor and its chip partner Tropic Square disclosed a related result: Donjon used the same technique, laser fault injection, on the TROPIC01 chip in the new Trezor Safe 7.
This time, it slipped past the chip’s firmware signature check to run its own code. Trezor said funds stayed safe because the Safe 7 stacks three separate security layers, and the layer guarding the PIN held firm. Unlike Tangem, Trezor, and Tropic Square, which could respond: they shipped a stopgap for current chips and are hardening the next version of the silicon.
Cheaper attacks on wallets go back further, but they hit softer targets. Years ago, this same team pulled the recovery seed straight off a stolen Trezor One or Trezor T with a rig costing about $100, because those wallets guarded their secrets with an ordinary microcontroller and no secure element.
Tangem’s hardened chip is the difference: it is why the same sort of physical attack now needs a quarter-million-dollar lab. It raises the bar; this research shows it does not remove the danger. And a grade like EAL6+ only vouches for the chip and its built-in defenses, not the code a wallet maker layers on top, which is where this flaw lives.
It is also Donjon’s third finding on Tangem. An Android app bypass could be patched, because it was in the software Tangem controls. But this laser attack and a password brute-force method found earlier both sit in the card’s firmware, which can never be changed.
What to do
For almost everyone, the answer is nothing new: keep the card where a thief cannot get to it. This attack cannot reach a card you still hold. If a Tangem card is lost or stolen and you are guarding serious value, move the funds now, using another card in your set (or a seed phrase, if you set one up), and stop relying on the password to protect a card you no longer control.
