The Hacker News22%
Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched 11%
By The Hacker News37%
7/12/2026, 1:11:21 PM
BS Summary: This article contains 2 faulty reasoning types, including Ad Hominem, with Indoctrination as the most egregious example at 7.1% saturation with 104 hits. Analysis detected 118 faulty-reasoning hits from 1,470 analyzed words, generating a BS Score of 27.6% and a BS Rank of 11% (13,528 of 15,051 articles). This article is better (less manipulative) than 89.90% of the article peer group.
Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched
Swati Khandelwal Jul 10, 2026 Vulnerability / Hardware Security
Researchers at Ledger's Donjon security team have shown that a precisely timed laser pulse, aimed at the chip inside a Tangem crypto wallet card, can reset the card's password to anything the attacker picks.
No old password.
No backup card.
Once it is reset, whoever did it controls the wallet and can move the coins out.
This is not an emergency for most owners.
The attack needs the physical card in hand and a lab that Donjon puts at around $250,000.
It also means cutting the card open, which leaves damage no one can miss.
It cannot be done over the internet, and there is no fix coming: Tangem cards cannot take software updates, so every card already sold carries the flaw.
The one group that should act now is anyone whose card is lost or stolen and holds serious value.
How the card is meant to protect you
A Tangem wallet looks like a plain bank card.
Tap it to your phone, and a companion app talks to a Samsung S3D232A chip inside.
That chip is a secure element, built to resist tampering and certified to a high grade called EAL6+.
It holds the secret key that controls your crypto and never lets it out.
Two things are meant to stand between a thief and your money: holding the card and knowing the password.
The weak point is the password reset feature.
Tangem sells its cards in linked sets, and if you forget your password, you can set a new one by holding two of your cards together.
Deep inside that process, the card runs a single check: is this card in recovery mode?
If yes, it accepts a new password without asking for the old one.
A laser pulse fired at the chip at the exact moment it runs that check does not quietly rewrite a stored value.
It briefly disturbs the chip's own circuitry, so the check misfires and the card behaves as if it were in recovery mode when it is not.
With the check defeated, the card's ordinary SetPin command accepts a brand-new password: no old password, no second card, no recovery step.
Turning the recovery feature off does not help, because the same check still runs on every card.
Hard to do, and unfixable
None of this is easy.
It took a laser rig, sensitive measuring gear, deep hardware skill, and a long stretch of up-front work to map the chip and find the exact spot and timing.
The card has to be cut open and its chip exposed, which leaves obvious damage.
There is no doing this quietly and slipping the card back into a pocket.
Donjon reports that once the settings were locked in, the attack worked on every card it tried, at about two hours each.
The team reported the flaw to Tangem on February 10, 2026.
The bigger problem is permanence.
Tangem builds its cards with no way to update the firmware, and presents that as a security feature: nothing can be changed, so nothing can be tampered with from a distance.
Here, that same design cuts the other way, leaving a flaw in the code that can never be corrected.
As the researchers put it, "there's no patch, but the attack is physical and invasive", so it cannot be done remotely.
Tangem pushed back.
In a public response , the company called this a lab-only physical method that works against secure element chips in general, not something unique to its cards.
It also noted that Donjon belongs to Ledger , one of its biggest rivals.
Its sharpest point is about money: a Tangem card carries nothing that says who owns it or how much it holds, so an attacker who spends $250,000 and wrecks cards to tune the attack has no way to tell whether a stolen card is worth $50 or $50 million.
Tangem also says no one has lost funds to a laser attack on any hardware wallet so far, and that for everyday users, "the practical risk is virtually non-existent."
Both sides are partly right.
Donjon researchers are right that the flaw is real, sits in every card, and can never be patched.
Tangem is right that for almost everyone, the cost, the ruined cards, and the guesswork over what a card holds make it pointless.
The place they actually meet is narrow: a lost, stolen, or seized card that an attacker already has reason to think is worth the trouble.
Not the first wallet chip broken this way
This is not Donjon's only laser attack on a hardware wallet this year.
In early June, Trezor and its chip partner Tropic Square disclosed a related result: Donjon used the same technique, laser fault injection, on the TROPIC01 chip in the new Trezor Safe 7.
This time, it slipped past the chip's firmware signature check to run its own code.
Trezor said funds stayed safe because the Safe 7 stacks three separate security layers, and the layer guarding the PIN held firm.
Unlike Tangem, Trezor, and Tropic Square, which could respond: they shipped a stopgap for current chips and are hardening the next version of the silicon.
Cheaper attacks on wallets go back further, but they hit softer targets.
Years ago, this same team pulled the recovery seed straight off a stolen Trezor One or Trezor T with a rig costing about $100, because those wallets guarded their secrets with an ordinary microcontroller and no secure element.
Tangem's hardened chip is the difference: it is why the same sort of physical attack now needs a quarter-million-dollar lab.
It raises the bar; this research shows it does not remove the danger.
And a grade like EAL6+ only vouches for the chip and its built-in defenses, not the code a wallet maker layers on top, which is where this flaw lives.
It is also Donjon's third finding on Tangem.
An Android app bypass could be patched, because it was in the software Tangem controls.
But this laser attack and a password brute-force method found earlier both sit in the card's firmware, which can never be changed.
For almost everyone, the answer is nothing new: keep the card where a thief cannot get to it.
This attack cannot reach a card you still hold.
If a Tangem card is lost or stolen and you are guarding serious value, move the funds now, using another card in your set (or a seed phrase, if you set one up), and stop relying on the password to protect a card you no longer control.
Found this article interesting?
Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.
cryptocurrency , cybersecurity , Embedded Security , Firmware Security , hardware security , password security , Physical Security , Vulnerability
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code
New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images
ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories
Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
European Parliament Member Investigating Spyware Was Hacked With Pegasus
⭐ Featured Resources
What 200+ Security Teams Reveal About Using IP Intelligence in 2026
Get Hands-On SANS Training for Today’s Cyber Defense and Offensive Security Challenges
See What’s Really Exposed Across Your IT, OT, IoT, Cloud, and Mobile Assets
Get Gartner’s Guide to AI Agent Supervision and Runtime Controls
Speakers
3speakers11%attributed speech1,308writer words
Voice mapSelect a segment to jump to its words
Selected voice
12%flagged-word coverageTangem
119 attributed words73% of attributed speech8.0% writer coverage
Indoctrination-8.0 pts
Writer 8.0%Tangem 0%
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.