Unpatchable Laser Attack Resets Every Tangem Wallet Password

Ledger Donjon, the security research arm of the hardware wallet maker, published findings Tuesday showing a precisely aimed laser pulse can bypass the password protection on every Tangem wallet card sold to date. The attack targets the Samsung S3D232A secure element chip inside the cards. Because Tangem cards lack any firmware update mechanism, the vulnerability is permanent. There is no fix the company can push out.

The technique is called laser fault injection, or LFI. Researchers fire a rapid laser pulse at a specific point on the chip while it processes a security check. The pulse causes the logic gate that verifies the password to glitch. Instead of returning a “no,” the chip enters what it thinks is a recovery state where a password reset is allowed, Donjon said. The attacker can then set a new password and gain full access to the wallet’s contents.

The Samsung chip carries an EAL6+ security certification, a high assurance rating. The attack requires physical possession of the card, access to laboratory equipment, and an estimated $250,000 in setup costs, according to Donjon’s report. It also demands advanced hardware security expertise, including the ability to characterize the specific chip and bypass protections like flash-write fault detection.

Ledger Donjon disclosed the vulnerability to Tangem on February 10, 2026, roughly five months before publishing the report on July 9. That follows a standard responsible disclosure timeline.

Tangem’s public response has been to downplay the risk. The company called the attack specialized, non-scalable, and closer to theoretical lab testing than a realistic threat for everyday users, Donjon said. The framing is not entirely wrong. It also sidesteps an uncomfortable reality: the flaw cannot be patched, and every card in circulation carries it permanently.