TANGEM WALLET: An Innovative Seedles Cold Wallet Setup

[satscraper]

Tangem has updated its mobile app to the latest version, 5.32.2.

The most notable change is that starting with this release this app has the option to function solely as the standalone BIP-39 compliant wallet ^{meaning it no longer requires Tangem hardware cards}. If users wish to upgrade and use the app with hardware cards later, they can do so by purchasing the cards separately.

It's also worth noting that the Tangem app is open source, so those who are obsessed about open source wallets can freely use it in standalone mode and sleep soundly.

[DaveF]

Tangem has updated its mobile app to the latest version, 5.32.2.

The most notable change is that starting with this release this app has the option to function solely as the standalone BIP-39 compliant wallet ^{meaning it no longer requires Tangem hardware cards}. If users wish to upgrade and use the app with hardware cards later, they can do so by purchasing the cards separately.

It's also worth noting that the Tangem app is open source, so those who are obsessed about open source wallets can freely use it in standalone mode and sleep soundly.

Makes you wonder how difficult it would be to actually make your own Tangem cards.
The cards are closed source, but I figure sooner or later someone could probably come up with another NFC card that talks to the app.
Would be pointless since it would be a support nightmare but more of an interesting thought experiment.

-Dave

[satscraper]

Tangem has updated its mobile app to the latest version, 5.32.2.

The most notable change is that starting with this release this app has the option to function solely as the standalone BIP-39 compliant wallet ^{meaning it no longer requires Tangem hardware cards}. If users wish to upgrade and use the app with hardware cards later, they can do so by purchasing the cards separately.

It's also worth noting that the Tangem app is open source, so those who are obsessed about open source wallets can freely use it in standalone mode and sleep soundly.

Makes you wonder how difficult it would be to actually make your own Tangem cards.
The cards are closed source, but I figure sooner or later someone could probably come up with another NFC card that talks to the app.
Would be pointless since it would be a support nightmare but more of an interesting thought experiment.

-Dave

I doubt this.

An insuperable obstacle for anyone attempting such thing would be the closed source microcode and firmware running on the chip inside Tangem card. However, if some leakage occurred on the manufacturer’s side, it might become possible to create “clones” that are indistinguishable from the original cards. The worst scenario would be if they managed to embed backdoors into these “fake” cards.

[DaveF]

I doubt this.

An insuperable obstacle for anyone attempting such thing would be the closed source microcode and firmware running on the chip inside Tangem card. However, if some leakage occurred on the manufacturer’s side, it might become possible to create “clones” that are indistinguishable from the original cards. The worst scenario would be if they managed to embed backdoors into these “fake” cards.

That is why I said talks to the app, not clones the Tangem card themselves.

Probably not worth the time & effort since if you are going to create new hardware, modding the open source wallet would be minor at that point to take your cards instead of theirs.

Was a better idea in my head until I actually thought it through.

-Dave

[fillippone]

Regarding the security of those cards, I wouldn't be too worried.
I guess the maximum amount of money I would be willing to charge on that device is probably a little bit more than the average cash I have in my wallet.

[satscraper]

Regarding the security of those cards, I wouldn't be too worried.
I guess the maximum amount of money I would be willing to charge on that device is probably a little bit more than the average cash I have in my wallet.

I trust it up to about $10K. Cards iself are quite secure ^{you might want to consider Tangem app fresh security audit conducted at the end of January 2026, cards security is at least comparable to that one traditionally associated with ordinary bank cards}. The most vulnerable part of Tangem's setup is the public APIs used to connect to blockchains, but even if something goes wrong at that layer, it doesn’t affect my private keys. So my $10K should remain safe. BTW, Tangem mobile app has been updated to version 5.33.1. At some points between 5.32 and 5.33 Tangem added the smart gas feature for paying network fees and I find it very convenient because there is no need now to top up wallet with native tokens to cover such fees.

[fillippone]

I trust it up to about $10K. Cards iself are quite secure ^{you might want to consider Tangem app fresh security audit conducted at the end of January 2026, cards security is at least comparable to that one traditionally associated with ordinary bank cards}.

The fact that they regularly undergo scrutiny and audit checks is reassuring. Of course, nothing beats a battle-tested provider; black hats have the maximum incentive to take advantage of any exploit. Even better if the provider itself is regularly challenged by white-hats.

[satscraper]

Tangem Pay is now available for customers "in select countries across the following regions: the USA, LATAM, APAC, MEA, and Africa". In the EU it is still not available ^{so I cannot test it}, but they have promised rapid expansion soon. To use this service, one needs to apply for  virtual VISA card directly inside Tangem app. This requires going through the standard KYC procedure.

[fillippone]

Tangem Pay is now available for customers "in select countries across the following regions: the USA, LATAM, APAC, MEA, and Africa". In the EU it is still not available ^{so I cannot test it}, but they have promised rapid expansion soon. To use this service, one needs to apply for  virtual VISA card directly inside Tangem app. This requires going through the standard KYC procedure.

Sorry,
this is not for me.
Everything that is KYC is not going to be tested by me. Happy to read your experiences. I prefer more convoluted, yet privacy-preserving spending methods.

[satscraper]

Tangem Pay is now available for customers "in select countries across the following regions: the USA, LATAM, APAC, MEA, and Africa". In the EU it is still not available ^{so I cannot test it}, but they have promised rapid expansion soon. To use this service, one needs to apply for  virtual VISA card directly inside Tangem app. This requires going through the standard KYC procedure.

Sorry,
this is not for me.
Everything that is KYC is not going to be tested by me. Happy to read your experiences. I prefer more convoluted, yet privacy-preserving spending methods.

I understand you. KYC is the terrible thing for many people ^{myself included} but personally, when the choice is between money and KYC, I choose the money if the KYC requirements don’t bother me too much. I already have a few crypto cards with KYC and plenty of bank cards with KYC, so one more doesn’t make a big difference as long as you know how to use them properly in a way that allows to not attract unnecessary attention.

[fillippone]

I understand you. KYC is the terrible thing for many people ^{myself included} but personally, when the choice is between money and KYC, I choose the money if the KYC requirements don’t bother me too much. I already have a few crypto cards with KYC and plenty of bank cards with KYC, so one more doesn’t make a big difference as long as you know how to use them properly in a way that allows to not attract unnecessary attention.

Indeed the way of using KYCd methods is much an undervalued technique to avoid "problems". Yet, with the advent of AI, I guess cross check control are becoming easier, so a reissued level of awareness is required. The high fees of non KYC products are the price for your privacy.

[satscraper]

From April 23, 2026 through July 2026 Tangem is running the giveaway campaign devoted to the 2026 FIFA World Cup.

Who can participate: virtually anyone, as the giveaway is global.

This giveaway includes:

1 BTC to be split across multiple winners throughout the summer.
20 match tickets to the biggest games at the tournament.
600 merch boxes containing the full Self Custody FC kit.

As I understand it the giveaway is based on challenges released on the two-weeks-basis for participants.

Here’s the page to join the campaign.

[satscraper]

Finally, the most requested feature has arrived in Tangem with the latest  5.39 release and this is  "Dynamic Address for UTXO" , i.e. Tangem wallet can now generate the fresh receiving address instead of reusing the same one. This update also includes UI changes and many improvements to swaps.

[safar1980]

Bypassing Tangem Card Security with a Laser Attack
After uncovering a genuine check bypass on the Tangem Android application and a brute-force attack on the card's authentication protocol, the Ledger Donjon turned its attention to the card itself with more advanced tools and sophisticated techniques. What we found is a critical vulnerability that lets an attacker with physical access to a single Tangem card reset its password and steal all associated funds.

— Using a single nanosecond laser pulse targeted at a specific location on the EAL6+ chip, the Ledger Donjon demonstrated a fault injection attack against Tangem hardware wallet cards. By evading the platform’s fault-detection countermeasures and faulting a single conditional check in Tangem’s firmware, we set the card’s access password to an attacker-controlled value.
— The vulnerability does not require knowledge of the existing password or possession of a backup card, and is not mitigated by disabling the recovery feature.
— The vulnerability affects all Tangem cards currently in circulation and cannot be patched, as the cards have no firmware update mechanism.1
— To be clear, the attack requires physical access to the Tangem card, and pulling off the attack demands specialized laboratory equipment (our setup costs around $250,000), software and hardware security expertise, and an extensive initial effort to characterize the chip, none of which is within reach of an individual attacker.

[satscraper]

The threat of attack that requires physical access, $250,000 to acquire equipment, special skills to work with this equipment, as well as relevant expertise in hardware security cannot be considered even a Mickey Mouse threat. The research itself can be regarded as a "mosquito bite" from Donjon. Owners of Tangem should not bother themselves with it.

[SFR10]

The vulnerability affects all Tangem cards currently in circulation and cannot be patched, as the cards have no firmware update mechanism.

This is one of the cons in such wallets, but considering that only specialized organizations ^{[e.g., government-related or in this case, Ledger Donjon]} have access to those expensive tools, I also agree with what satscraper said about Tangem owners shouldn't worry much ^{[for those who'd like to improve the situation to a small extent, you can now get their "Stealth Cards" with a 10% discount until July 20 (use the following code: STEALTH10)]}.

[fillippone]

Also, just remember what these wallets are meant for.
Nobody in his right mind would deposit on these devices a considerable amount of money.
It is meant to be something when you are on the move.
So I guess this attack has a very low implied ROI, that is quite encouraging.

[satscraper]

Also, just remember what these wallets are meant for.
Nobody in his right mind would deposit on these devices a considerable amount of money.
It is meant to be something when you are on the move.
So I guess this attack has a very low implied ROI, that is quite encouraging.

Yeah, I mainly use it to top up my crypto card whenever it doesn't have enough balance to cover my shopping expenses. Usually around 2000 EUR is enough to do the trick. So Tangem essentially acts as a mediator between my primary wallet ^{Passport Core} and the crypto card because it's quick to pull out and tap, which makes Tangem far more practical for everyday spending. Passport Core itself isn't really suited for use when you're on the move.

[dkbit98]

Bypassing Tangem Card Security with a Laser Attack

I guess dkbit98 was right after all when he repeatedly warned everyone to stay away from tangem crap  
They have terribly bad products on both hardware and software level, and there is no way they can fix that.
Good job from Donjon research team yet again, they are the only bright spot in ledger team.

PS
Donjon should try to do the same thing with Satochip cards, if they can 

[DaveF]

Bypassing Tangem Card Security with a Laser Attack

I guess dkbit98 was right after all when he repeatedly warned everyone to stay away from tangem crap  
They have terribly bad products on both hardware and software level, and there is no way they can fix that.
Good job from Donjon research team yet again, they are the only bright spot in ledger team.

PS
Donjon should try to do the same thing with Satochip cards, if they can 

Don't see why it would be any more difficult to do Satochip or any other card. If you have the time and money and are willing to put in the effort it's been proven that it can be done.
Fly to Vegas for Black Hat / DefCon next month. And see what unhackable things are hacked live onstage.

Goes back to what has been said for anything like this don't store more then you can loose.
Part of what makes Tangem nice is that it's a thin card that you can carry with you. That does not make it secure against the $5 ($8 with inflation) wrench attack.
It makes it more secure then just a hot wallet on your phone. But pull a gun on me and I will cheerfully hand over all the crypto in my hot wallet on the phone and I will even hand over the warm / cool funds which I consider Tangem (don't use Tangem but similar and carried with me). Combined it's all worth less then the phone.

-Dave