A physical attack requiring $250k in lab equipment — Tangem is taking some unfair blame, but the inability to upgrade firmware is indeed a hard flaw.

Ledger's security research team Donjon disclosed a security vulnerability in Tangem hardware wallets. The research shows that after obtaining the physical card, an attacker can use laboratory-grade Laser Fault Injection to bypass the firmware's recovery state verification, reset the wallet PIN, and sign transactions. Ledger stated that the attack requires chip disassembly, laboratory equipment worth approximately $250k, and specialized technical expertise, and cannot be executed remotely. However, since Tangem's firmware is not upgradable, the vulnerability cannot be fixed through firmware updates.