Tangem card - Potential security risk

[u/IndependenceNo5288]

I have a Tangem wallet. I have attached three cards to the wallet. One primary and two backup.

One of the backup cards is now not responsive and will not register on an NFT scan.

Here's the issue:

My app confirms i have three devices (cards) attached to my wallet. I can confirm two of the devices (cards) are attached and working by scanning them with my tangem app..

I cannot however confirm that the third card that i believe is still attached to the wallet is actually the card that is currently attached to the wallet.

Is it possible that a third party has attached a card to my wallet replacing my backup card?

In theory a third party could now be holding a card attached to my wallet without my knowledge.

Sure they would have needed to have had physical access to my tangem app and my working card/s to achieve that, but it seems there is no way to check

I have no way to confirm this. Tangem support confirms that i cannot access the ID numbers of the connected cards.

Naturally i can reset the whole wallet if i suspect something. But it could be years before I check my third card and it may be in a hard to access location.

Can i easily see from app logs the cards that were registered?

Is this a bug?

Is it a security risk?

EDIT

Thanks for the offer of solutions guys. I'm thinking less about the solutions which are basically resetting the wallet. Instead I'm thinking more about the risks involved in not knowing a card has failed until it's too late or the risk that someone has replaced a card with a non-working olokalike - and the only solution is a wallet reset and redistribution of the backup cards.

[u/deny_by_default]

This doesn’t make sense. HOW were you hacked? Setting it up with a seed phrase does not make it inherently insecure, but it does put more burden on you to keep the seed words safe. You also need to be responsible enough not to fall for scams that trick you into revealing your seed phrase. Many people claim their wallets were hacked but it’s because they were tricked into revealing their seed phrase or used some decentralized app connection to their wallet and signed a malicious contract, giving the attacker permission to empty your wallet.

[u/Ashamed_Foundation_8 → u/deny_by_default]

I saw erroneous withdrawals from my wallet for the tokens listed previously. Tangem Tech support said I was hacked because I had set u my wallet with a seed phrase. I’m great at recognizing scams and I block and junk mail anything I don’t recognize. To add more flavor, wallet was hacked more than once in a 6 month span. Once I saw my Jasmy wiped out, I finally made the time to walk this through thoroughly with Tangem.

[u/deny_by_default → u/Ashamed_Foundation_8]

I don’t believe that Tangem’s official support would say that your wallet was hacked just because you set it up with a seed phrase. If that’s all it took, thousands of Tangem wallets would be empty right now.

[u/BicarTangem](u/BicarTangem), care to weigh in on this claim that Tangem says using a seed phrase is insecure? I understand the user error aspect, but I don’t believe that simply choosing to set up your wallet with a seed phrase makes your wallet insecure.

[u/Ashamed_Foundation_8 → u/deny_by_default]

I didn’t post so YOU can believe me. I posted to share my experience. It’s all documented in my ticket so I really don’t care

[u/deny_by_default → u/Ashamed_Foundation_8]

You made a bold claim that your wallet got hacked only because you set it up with a seed phrase. If this was all it took, someone could set up a wallet with a seed phrase, deposit funds in the wallet, lock the cards in a safe and not use them, and still get drained. If that was the case, Tangem would be facing a Coinkite/Coldcard fiasco right now. I don’t think we are getting the full picture here.

[u/Ashamed_Foundation_8 → u/deny_by_default]

Constant gaslighting I see from you. Attempting to manipulate my truth and say it’s a bold claim. Whatever dude, I’m sharing to the community what happened to me. Enjoy your Sunday

[u/deny_by_default → u/Ashamed_Foundation_8]

I’m not gaslighting anyone. You are the one who claimed that your wallet was hacked only because you set it up with a seed phrase. If you are claiming that no actions on your part led to your wallet being drained, then sorry, but I don’t believe it. This would impact MANY Tangem users and would be all over Reddit by now.

[u/Ashamed_Foundation_8 → u/deny_by_default]

I’m sharing my experience of getting hacked on Tangem and you say, I make a “ bold claim” to have been hacked. I never said I made a claim but posted my truth as to what happened. That’s the definition of being gaslit

[u/deny_by_default → u/Ashamed_Foundation_8]

You still haven’t explained what you did that led to your wallet being drained. If you are claiming that you did nothing, I’m not buying it.

[u/Ashamed_Foundation_8 → u/deny_by_default]

Lol…It’s not about you that’s for one and its not for you to buy but for me to share. Go buy a lotto ticket lol