Briefing
A significant vulnerability has been disclosed in Tangem cold wallet cards, enabling a “tearing attack” that bypasses PIN attempt limits. This flaw, identified by Ledger’s Donjon team, allows for accelerated brute-force attacks on the card’s PIN by interrupting power during failed attempts. While the attack requires physical proximity and specialized equipment, it drastically reduces the time needed to compromise a wallet, posing a direct threat to user asset security. The vulnerability is unpatchable on existing cards, highlighting a critical hardware-level security concern.
Context
Hardware wallets are designed to provide robust offline security for digital assets, often relying on physical tamper-detection and limited PIN attempts to prevent unauthorized access. The expectation is that such devices are resistant to physical brute-force methods. However, the discovery of this “tearing attack” reveals a previously unaddressed attack surface, challenging the fundamental security assumptions of certain cold storage designs and demonstrating that even physically secured devices can harbor subtle, exploitable flaws.
Analysis
The incident centers on a physical “tearing attack” against Tangem cold wallet cards. The specific system compromised is the card’s internal security mechanism that registers failed PIN attempts. By physically cutting the card’s power supply precisely as a PIN attempt fails, the attacker prevents the card from recording the failed attempt, thereby circumventing the built-in attempt limits.
Simultaneously, electromagnetic emissions analysis is used to detect when a correct PIN combination is entered, streamlining the brute-force process. This chain of events allows an attacker with physical access to bypass the intended security measures and rapidly discover the user’s PIN, fundamentally undermining the card’s protection against unauthorized access.
Parameters
- Targeted Hardware → Tangem Cold Wallet Cards
- Attack Vector → Brute Force via “Tearing Attack”
- Vulnerability Type → PIN Attempt Limit Bypass
- Discovery Source → Ledger’s Donjon Team
- Estimated Attack Cost → $5,000
- Estimated Time (8-digit PIN) → ~460 days (down from 148 years)
- Patch Status → Unpatchable on existing cards
- Disclosure Date → September 18, 2025
Outlook
Users of Tangem cards are advised to immediately strengthen their PINs to eight or more alphanumeric characters and symbols, as existing cards cannot be patched. This incident underscores the necessity for rigorous, adversarial physical security testing in hardware wallet design and the importance of multi-factor authentication beyond simple PINs. It will likely prompt a re-evaluation of certification standards for cold storage devices and emphasize the need for transparency in vulnerability disclosures across the digital asset security industry.
Verdict
This hardware-level vulnerability in Tangem cold wallets represents a significant, unpatchable flaw that necessitates immediate user action and a re-evaluation of physical security assumptions in the digital asset ecosystem.
Signal Acquired from → Protos
