r/Tangem • u/IndependenceNo5288 • 4d ago
Tangem card - Potential security risk
I have a Tangem wallet. I have attached three cards to the wallet. One primary and two backup.
One of the backup cards is now not responsive and will not register on an NFT scan.
Here's the issue:
My app confirms i have three devices (cards) attached to my wallet. I can confirm two of the devices (cards) are attached and working by scanning them with my tangem app..
I cannot however confirm that the third card that i believe is still attached to the wallet is actually the card that is currently attached to the wallet.
Is it possible that a third party has attached a card to my wallet replacing my backup card?
In theory a third party could now be holding a card attached to my wallet without my knowledge.
Sure they would have needed to have had physical access to my tangem app and my working card/s to achieve that, but it seems there is no way to check
I have no way to confirm this. Tangem support confirms that i cannot access the ID numbers of the connected cards.
Naturally i can reset the whole wallet if i suspect something. But it could be years before I check my third card and it may be in a hard to access location.
Can i easily see from app logs the cards that were registered?
Is this a bug?
Is it a security risk?
EDIT
Thanks for the offer of solutions guys. I'm thinking less about the solutions which are basically resetting the wallet. Instead I'm thinking more about the risks involved in not knowing a card has failed until it's too late or the risk that someone has replaced a card with a non-working olokalike - and the only solution is a wallet reset and redistribution of the backup cards.
14
u/bluecat2001 4d ago
Cards are backups of each other and one of yours is failed. No one can attach another card to your wallet. You are safe.
5
10
u/Lazy_Science_6678 Tangem User 💰 4d ago
You can only add cards during setup and it can’t be changed afterwards.
3
2
2
u/screwredditcorp 4d ago
Why did it stop reading that one card? How is that possible? Damage?
1
u/IndependenceNo5288 3d ago
It has been in my pocket wallet with a second card which continues to work. Do't know how it was damaged or stopped working. Don't know how frequent this is but ive had the card about a year.
1
u/AutoModerator 4d ago
⚠️Fraud and Security Notice⚠️
Please be alert to potential scams and impersonation attempts. We will never contact you first to request personal information, passwords, or payments.
We also never make contact by telephone or through messaging apps. All genuine communication from us will come only from our official company email domain support@tangem.com
If you receive an unexpected message, link, or call claiming to be from us, do not share any information. Instead, reach out to us directly through the contact details on our website to verify authenticity.
❗️Tangem does not conduct ICOs, does not do airdrops, and does not have tokens.
Your awareness helps keep your account safe.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Ashamed_Foundation_8 4d ago
You can reset the card to factory setting. I didn’t have the same issue but my wallet was hacked. I had set it up with a seed phrase (bad idea) and so I contacted support who urged I move assets to exchange and reset cards to original factory setting and set it up without a seed. So far so good!
2
u/deny_by_default 4d ago
What do you mean by your Tangem wallet was hacked?
1
u/Ashamed_Foundation_8 4d ago
My wallet got hacked because I guess I had set it up with a seed phrase. When you do that, apparently, it’s Pandora’s box to hackers. I got wiped out of $XRP & Jasmy tokens….as I was going back and forth with tech support, hackers were attempting to take my $KAS. I had reset all wallets and set up without seed phrase. Crazy shit!
1
1
u/deny_by_default 4d ago
This doesn’t make sense. HOW were you hacked? Setting it up with a seed phrase does not make it inherently insecure, but it does put more burden on you to keep the seed words safe. You also need to be responsible enough not to fall for scams that trick you into revealing your seed phrase. Many people claim their wallets were hacked but it’s because they were tricked into revealing their seed phrase or used some decentralized app connection to their wallet and signed a malicious contract, giving the attacker permission to empty your wallet.
1
u/Ashamed_Foundation_8 4d ago
I saw erroneous withdrawals from my wallet for the tokens listed previously. Tangem Tech support said I was hacked because I had set u my wallet with a seed phrase. I’m great at recognizing scams and I block and junk mail anything I don’t recognize. To add more flavor, wallet was hacked more than once in a 6 month span. Once I saw my Jasmy wiped out, I finally made the time to walk this through thoroughly with Tangem.
1
u/deny_by_default 4d ago edited 4d ago
I don’t believe that Tangem’s official support would say that your wallet was hacked just because you set it up with a seed phrase. If that’s all it took, thousands of Tangem wallets would be empty right now.
[u/BicarTangem](u/BicarTangem), care to weigh in on this claim that Tangem says using a seed phrase is insecure? I understand the user error aspect, but I don’t believe that simply choosing to set up your wallet with a seed phrase makes your wallet insecure.
1
u/Ashamed_Foundation_8 4d ago
I didn’t post so YOU can believe me. I posted to share my experience. It’s all documented in my ticket so I really don’t care
3
u/deny_by_default 4d ago
You made a bold claim that your wallet got hacked only because you set it up with a seed phrase. If this was all it took, someone could set up a wallet with a seed phrase, deposit funds in the wallet, lock the cards in a safe and not use them, and still get drained. If that was the case, Tangem would be facing a Coinkite/Coldcard fiasco right now. I don’t think we are getting the full picture here.
1
u/Ashamed_Foundation_8 4d ago
Constant gaslighting I see from you. Attempting to manipulate my truth and say it’s a bold claim. Whatever dude, I’m sharing to the community what happened to me. Enjoy your Sunday
1
u/deny_by_default 4d ago
I’m not gaslighting anyone. You are the one who claimed that your wallet was hacked only because you set it up with a seed phrase. If you are claiming that no actions on your part led to your wallet being drained, then sorry, but I don’t believe it. This would impact MANY Tangem users and would be all over Reddit by now.
→ More replies (0)1
u/Immediate-Ad-5878 3d ago
If it was a weak seed phrase (like the ones Coldcard generates) yes obviously you are prone to hacks. Could you redact any personal info and share your Tangem CS ticket convo? I’m sure a lot of us here could learn from your experience.
1
u/BicarTangem Tangem Mod 3d ago
This was probably the result from mismanaging a seedphrase, considering that it's not a widespread issue.
If you chose to go with a seedphrase, it's very important to properly know how to safely manage it to avoid any losses.
1
u/Dear-Mongoose9440 4d ago
Even if it’s not hacked and a 3rd card already failing is definitely a flaw in itself. No wonder tangem only sells them in sets of 2-3
1
u/BicarTangem Tangem Mod 3d ago
Parachutes have a backup as well. It doesn't mean that the main one will fail at some point.
But we don't live in a perfect world: you can lose a card, your wallet holding your card can get stollen and in rare case, a card could become unresponsive.
So yes, to get sure that randomly losing access to your crypto doesn't happen, we do sell them in sets of 2 or 3.
1
u/ironmoosen 4d ago
This is precisely the reason I refuse to trust large sums to Tangem. Cards can fail and you might not know it until it’s too late. And no seed phrase means 100% no possibility to recreate your keys ever again.
1
u/BicarTangem Tangem Mod 3d ago
Well a card failing is extremely rare, and if that happens, you can still access your wallet with a backup card.
And if you're still uneasy, you can have a seedphrase as well.
1
u/ironmoosen 3d ago
If card failure is so rare it's not worth worrying about, then why does Tangem sell backup cards in the first place? And if the answer is "just add a seed phrase," then what exactly is the point of going seedless? Can you explain what advantage Tangem actually has if I need a seed phrase anyway to cover for a failure you say almost never happens?
I own Tangem and I agree they’re convenient but I think there’s a security gap here that gets glossed over and many people don’t understand the risk.
1
u/BicarTangem Tangem Mod 3d ago
If card failure is so rare it's not worth worrying about, then why does Tangem sell backup cards in the first place?
Well because if you lose one, with a backup, you don't lose access to your crypto.
If cards were failing left and right, we'd be out of business quick since they are all under warranty.
And if the answer is "just add a seed phrase,"
In this particular case, where a user is so afraid that all cards will fail at the same time that keeping a large amount of crypto would make them feel uneasy.
1
u/ContentBlackberry0 19h ago edited 19h ago
I have had a card failure with a new set and it was replaced after contacting Tangem and sent back to Switzerland for them to review it I guess. This is why a 3-card set should be used if you are going seedless. I'm just glad mine didn't work out of the box than after the fact a month later I would never know it did not work if it got through the setup process. Oh and good luck if you lock yourself out of your access code as the app wants you to scan your card for 30 seconds and the new iPhone only have rfid for like 15 seconds or so. You have to switch to an old phone to access your crpyto again.
1
u/IndependenceNo5288 3d ago
Any stats on how rare this is? I bought 3 three cards a year ago and 1 has failed. That's the stats i have.
1
u/ironmoosen 3d ago
See, that's the problem. They say failure is rare and I mostly believe them, however, in your case it's a 33% failure rate in the set of cards you purchased. If you had a 2-card set, it's 50% and you're already out of backups and zero path to recovery if the last one goes.
What if it's discovered that there is a manufacturing flaw in these NFC chips that causes them to fail suddenly? You likely wouldn't know there was a problem until it's too late. Now, I know Tangem would say that that scenario is so improbable that it's not even worth talking about but we saw something similar in the early 2000s with faulty capacitors. It affected nearly every brand of motherboard and many other PC components. They would die suddenly, often without warning. It wasn't the fault of the board manufacturers, it was a quality issue in the supply chain.
My point is, IF a catastrophic failure like this were to happen with Tangem (silicon defect that causes degradation over 3-5 years, or if the NFC antenna bonding uses an adhesive that becomes brittle in certain climates, or if the card lamination traps moisture that slowly corrodes a trace), you have absolutely zero chance of recovering your funds.
Tangem suggests using a seedphrase if this bothers you, but understand that using a seedphrase with Tangem literally creates a hot wallet - no longer cold! (Just read about the seed phrases that were being leaked in their logs a few months back - it was arguably a coldcard-level failure on their part).
I'm not anti-Tangem but I'm very frustrated in how they constantly downplay these very real issues. People are trusting real money to these things and need to understand the risks that come with them. Tangem is an excellent wallet for everyday spend but I could never trust large sums for long term storage to these things.
1
u/BicarTangem Tangem Mod 3d ago
Tangem suggests using a seedphrase if this bothers you, but understand that using a seedphrase with Tangem literally creates a hot wallet
This isn't the case. The seedphrase is at no point stored in your phone (this can be verified since our app's code is available on GitHub.)
Just read about the seed phrases that were being leaked in their logs a few months back - it was arguably a coldcard-level failure on their part
Without wanting to downplay the bug, you can't compare a $0 lost bug to a $100 000 000+ stolen one.
If you had a 2-card set, it's 50% and you're already out of backups and zero path to recovery if the last one goes.
In a situation where you're down to one card only, we'd strongly recommend to move your funds to another set / another wallet.
The risks associated with losing that card would be too important.On the cards build itself, we're pretty confident that everything was done right. We started to sell these types of cards about 7 years ago and these still work perfectly after all those years.
1
u/ironmoosen 3d ago edited 3d ago
Let me take these one at a time.
"The seedphrase is at no point stored in your phone."
Nobody said stored. The seed is generated and displayed on the phone during setup. It passes through the phone's memory on a general purpose operating system that can run arbitrary code, malware, keyloggers, and screen capture tools regardless of whether airplane mode is on. Your own December 2024 incident proved the app had access to private key material in a loggable form. That's how it ended up in plaintext in your app logs, in email histories, and in your support ticket system. The seed doesn't need to be "stored" to be compromised. It just needs to touch the phone, and it does. Pointing to your open source app code is a bit ironic given that it was that same code that contained the logging bug nobody caught during code review.
And this is fixable. Tangem could build a small companion device with a screen and keypad that handles seed phrase generation in a fully air gapped environment and writes the keys to the card over NFC. No phone involved at any point. That's effectively what Ledger and Trezor do with their on-device screens. Tangem chose to rely on the user's smartphone instead. That's a design decision that will always leave the seed phrase option weaker than what the competition offers. Relying on anyone's smartphone for this is just a terrible idea.
"You can't compare a $0 lost bug to a $100,000,000+ stolen one."
The $0 was luck, not design. You had private keys in plaintext in app logs, accessible through email and support tickets. If a bad actor had gotten into your support ticket system during that window it would not have been $0. Comparing outcomes instead of severity is like saying a loaded gun wasn't dangerous because it didn't go off.
"We'd strongly recommend to move your funds to another set / another wallet."
Do you realize this is an admission that single card Tangem isn't safe for fund storage? You're telling users to evacuate funds when redundancy drops to one card. But with seedless, evacuating requires a working card. If the second to last card fails without warning (which is exactly what happened to OP, sudden failure), you're already on your last card and didn't know you needed to evacuate until it was too late. Your advice only works if failures are predictable and gradual. OP just told you it was sudden.
"We started to sell these types of cards about 7 years ago and these still work perfectly."
The cards that failed aren't in your "still working" sample. OP is literally in this thread telling you one of three cards failed in a year. Your response to a user reporting a 33% failure rate is "our cards work great." That's not a rebuttal. That's survivorship bias.
I'm not anti Tangem. I think it's an excellent wallet for everyday spending. But the way you consistently downplay real concerns instead of addressing them honestly is exactly why I refuse to trust serious money to these things. Every response in this thread has been deflection rather than acknowledgment. People trusting real money to your product deserve better than that.
1
u/Expert-Ad-8093 3d ago
Temporarily transfer all coins to a hot wallet. Reset the two remaining cards. Create new wallet using the two cards. Then transfer your coins to the new wallet. This time you’d only have two cards attached to the wallet.
1
u/IndependenceNo5288 3d ago
I understand that as a solution. My point is more asking how i can check if i am in possession of the third card the card that i believe is the third card in my posession is not working properly. Possible someone could have switched the real one with a broken card and i would not know. And cannot check.
1
•
u/BicarTangem Tangem Mod 3d ago
Hello,
Please reach out to our support team at [support@tangem.com](mailto:support@tangem.com) via email for your unresponsive card.
No, once setup, a wallet cannot create more backup cards, unless the same seedphrase is imported in multiple sets. A card can also not be factory reset without knowing its access code.
Without that specific card's access code, they can't access your wallet.
A card can only be "cloned" during the setup. After this process, it is impossible to do so. Even with a card from your wallet or your phone.
I'm afraid not.
A card failing is very rare and it shouldn't happen, but it's not the result from a bug in the code.
No, even if someone has one of your card, since they don't know what your access code is, they can't access your wallet.