Laser fault injection bypasses Tangem card access codes
Who is affected
Someone who steals a card and has laboratory equipment can sign transactions without the access code. Cards already sold cannot be patched.
What happened
Ledger’s Donjon security team, which works for a competing manufacturer, published a laser fault-injection attack on Tangem cards on 9 July 2026. With a card physically in hand, the researchers opened it and used precisely timed laser pulses to skip a check, which let them set a new access code without knowing the old one and then sign transactions. The private key is not extracted.
According to Donjon, the attack applies to all Tangem cards in circulation, and because the cards have no firmware update mechanism it cannot be patched on cards already sold. The attack requires stealing the card, visibly damaging it, laboratory equipment costing roughly $250,000 and specialist skills. Tangem calls the risk to everyday users “virtually non-existent”.
What this means for owners: the practical exposure is a lost or stolen card. Keep track of your cards, and if one goes missing, move funds to a wallet the missing card cannot access.
A private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Hardware attack) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideEvil Maid Attack: Protecting Unattended Hardware Wallets
Someone accesses your wallet while you are away. Hotel rooms, offices, shared spaces — how to detect and prevent physical tampering.
Read GuideProtecting Your Hardware Wallet from Physical Theft
What happens if someone steals your hardware wallet? How to set up layers of protection so theft alone cannot compromise your crypto.
Read GuideFault Injection
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Side-Channel Attack
A side-channel attack in cryptocurrency and blockchain targets indirect information, like power usage or timing, to extract sensitive data from a system or device.
Secure Element
A secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Evil Maid Attack
An evil maid attack is a physical security threat where an attacker gains temporary unsupervised access to a hardware wallet to tamper with it, install malicious firmware, or extract private keys.
Cite this entry
WalletInsights. “Laser fault injection bypasses Tangem card access codes”. Hardware wallet security incident tracker. Last verified October 26, 2026. https://walletinsights.io/en/security-incidents/tangem-laser-fault-injection-2026/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.