Tangem app logged seed-phrase private keys sent to support
Who is affected
Users who activated a seed-phrase wallet and contacted Tangem support through the app within 7 days had their private key included in the logs sent to support. Tangem states fewer than 0.1% of users were affected, the logs were deleted and no funds were lost.
What happened
On 29 December 2024 Reddit user u/areklanga alleged that private keys of Tangem users were sitting in support email histories accessible to Tangem staff. Tangem acknowledged the issue on 30 December and released a fix; it published a blog post on 31 December.
Tangem states that when a wallet was activated with a seed phrase, generated or imported, the private key was mistakenly written to the mobile app’s logs, which are attached when a user contacts support through the app. It attributes the bug to an NFC logging mechanism added to improve performance on certain devices that was missed in code review and testing. Wallets created without a seed phrase, where keys are generated on the card, were not affected.
According to Tangem, fewer than 0.1% of users were potentially affected: those who activated a seed-phrase wallet and contacted support through the app within 7 days of activation. Tangem says it permanently deleted all logs and attachments sent to support, added an in-app notice asking seed-phrase users whether they contacted support in that window, and fixed the bug in app versions 5.19.1 (App Store) and 5.19.2 (Google Play). Cointelegraph and CoinMarketCap report criticism that Tangem made no announcement on its social channels when the issue surfaced, and the Reddit user said an earlier post on the topic had been deleted.
What Tangem advises (affected users):
- Update the app, move funds out of the affected wallet and reset the wallet to factory settings.
- Reactivate it without a seed phrase or with a new seed phrase, then move the funds back.
A private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
A mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionNFC Connectivity in cryptocurrency enables contactless transactions using near-field communication, allowing users to sign or authorize actions by tapping their device to a reader.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Software vulnerability) and the glossary terms that describe it.
How to Protect Your Crypto from Hackers
Practical steps to protect your cryptocurrency from hackers, malware, phishing, and social engineering attacks.
Read GuideHow to Send Crypto Safely
Sending crypto can be scary — one wrong address and funds are gone forever. Follow this guide to send safely.
Read GuideMalware
Malware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Blind Signing
Blind signing is the process of signing a transaction without viewing its contents, typically used in hardware wallets for enhanced security.
Cite this entry
WalletInsights. “Tangem app logged seed-phrase private keys sent to support”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/tangem-app-seed-phrase-logging-bug-2024/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.