Ledger Donjon Reveals Laser Attack Vulnerability in Tangem Hardware Wallets; Dispute Over Security Standards Intensifies

On July 10, 2026, Ledger Donjon, the security research department of hardware wallet manufacturer Ledger, disclosed a sophisticated laser-based attack method that can reset Tangem card passwords. This announcement suggested the possibility of bypassing the card's firmware recovery-state check process, but Tangem dismissed the threat to general users as "virtually non-existent," sparking a debate between academic vulnerabilities and practical security.

As both sides maintain their positions, this incident presents a new phase in the competition over hardware wallet physical security standards and technical reliability between manufacturers. While Ledger emphasizes its role as a security watchdog, Tangem has responded by prioritizing safety in real-world usage environments.

The vulnerability announced by Ledger Donjon directly targets the Samsung S3D232A Secure Element embedded in Tangem cards. Researchers stated they succeeded in bypassing the chip's recovery-state check process by irradiating a specific point with a laser, ultimately resetting the user-defined password. This vulnerability was first reported to Tangem on February 10, 2026, and detailed information was released to the public today after a grace period of approximately five months.

"We believe Ledger's research is technically interesting but does not pose a threat to actual users. This is a purely academic attack possible only in a laboratory environment."

The core of the laser attack lies in physically interfering with the chip's internal logic circuits to skip normal security procedures. To achieve this, Ledger researchers removed the card's outer shell, exposed the chip's die, and applied laser pulses with precise timing. If such an attack succeeds, the card recognizes the security authentication as complete and grants access to the attacker, creating a critical path that could lead to asset theft.

Technical Analysis: Laser Glitching and Bypassing Security Delays

This research is an extension of the 'Tearing' attack previously announced by Ledger. A tearing attack is a technique that neutralizes security delay mechanisms by repeatedly cutting power during computation. By synthesizing these vulnerabilities found in Tangem's secure channel implementation, Ledger aimed to demonstrate that an attacker with physical access could discover the PIN through brute-force methods. The table below summarizes the key security vulnerabilities identified by Ledger Donjon.

• Laser state manipulation using the physical characteristics of the Samsung S3D232A chip
• Possibility of password reset through bypassing firmware-level recovery logic
• Neutralization of security wait times and brute-force attacks using power-off techniques
• Vulnerability in bypassing the genuine authentication logic of the Android application

Tangem maintains the position that there is no practical risk regarding these claims. They explain that Tangem cards are designed exclusively for NFC and have no physical data ports, and the probability of the chip itself being damaged during the process of an attacker destroying the card to expose the chip is very high. They also added that if a strong access code combining letters and numbers is used instead of a typical 4-6 digit PIN, it would take hundreds of years to crack the password even if the security delay is bypassed.

The difference between security certification levels EAL6+ and EAL5+ is also a major point of contention. Tangem emphasizes that its products use Samsung chips with EAL6+ certification, the highest level in the industry, and claims they are more resistant to physical hacking than Ledger, which remains at EAL5+ certification. On the other hand, Ledger counters that the actual implemented security architecture and verification through continuous attack testing are more important than certification levels. A comparison of the hardware security designs of the two products reveals the following differences.

Strategic Competition and Security Disputes in the Hardware Wallet Market

Ledger has built an image of leading industry security standards by continuously discovering vulnerabilities in competitors' products through its security research team, Donjon. This is interpreted as a strategy to reinforce the marketing message that its products are the safest, going beyond simple technical superiority. Ledger clarified that this disclosure is for the public interest of user safety and stated that testing the limits of hardware security contributes to the development of the entire industry.

Tangem is strongly reacting to Ledger's actions, defining them as 'fear marketing.' In particular, Tangem launched a counterattack by mentioning precedents where Ledger exposed customer data multiple times, such as the past Global-e partner leak, threatening the physical safety of users. As the debate over technical vulnerabilities turns into an emotional war of words between the two companies, users are confused about which security metrics to trust more.

User Response Measures and Future Outlook

Security experts believe this controversy will serve as an opportunity to raise awareness about the physical security of hardware wallets. Tangem users must set complex access codes containing both letters and numbers to enhance security and keep their cards physically safe to prevent exposure to others. While laser attacks are a laboratory-level threat, the importance of physical security cannot be overstated. In the second half of 2026, firmware updates to address these vulnerabilities or additional security audits by third-party organizations are expected to follow.