Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched

Summary: Researchers at Ledger's Donjon security team showed that a precisely timed laser pulse aimed at the Samsung S3D232A secure element inside a Tangem crypto wallet card can make its recovery-mode check misfire, so the card's SetPin command accepts a new password with no old password and no second card. The attack requires cutting the card open and a lab Donjon puts at around $250,000, worked on every card it tried at about two hours each once settings were locked in, and cannot be patched because Tangem cards take no firmware updates; the team reported the flaw to Tangem on February 10, 2026.
Key Takeaway: Every Tangem card already sold carries a flaw that can never be corrected, and the one group the researchers say should act now is anyone whose card is lost or stolen and holds serious value. Tangem's counterargument rests on the attacker not knowing whether a card is worth $50 or $50 million - a bet that only holds while the card stays in your hands.

Read the original at The Hacker News ↗