Rumor vs. Reality: Are Tangem Cards Vulnerable to Brute-Force Attacks?

AI summary

A recent report from Ledger's Donjon research team described a theoretical lab-based method to guess Tangem card access codes, but the technique is impractical in real-world scenarios. The attack requires physical possession, specialized equipment, and would destroy the chip before succeeding, making it impossible for thieves to exploit. Tangem cards remain secure for everyday use, and users are encouraged to use strong access codes and keep their cards safe.

A recent report from Ledger's research team, Donjon, described a sophisticated lab-based technique for guessing access codes on Tangem cards. We want to be clear: this research describes a hypothetical risk that is impossible to exploit in a real-life scenario. 

Here’s why this isn’t a practical threat to you or your funds.

What Ledger's Donjon reported

In a controlled lab setting, Donjon’s researchers used specialized equipment to bypass the standard time delays that protect against incorrect access code attempts. 

Bypassing this basic safeguard requires physical possession of the card, specialized expertise, and significant resources. Even under these perfect lab conditions, the attack is destined to fail.

Why this isn't a real-world threat

While academically interesting, this method falls apart in the real world for several key reasons:

• Guaranteed chip failure: The technique relies on "tear attacks" that repeatedly interrupt the chip's memory. This process physically damages the chip. Long before an access code could be guessed, the card would be rendered permanently inoperable, making the attack self-defeating.
   
• Misleading premise: The research oddly focuses on 4-digit PINs. Tangem uses alphanumeric access codes that support letters, numbers, and symbols (around 96 possible characters on a standard phone keyboard), making a real-world brute-force attack exponentially more difficult than suggested.
   
• Prohibitive timelines: Even under their optimal conditions, the time required makes the attack purely theoretical. At a rate of four guesses per second, cracking a 4-character access code would take about 7.5 months. A 5-character code would take over 64 years.
  
  (The math for a 4-character code: 96^4 combinations ÷ 4 attempts/sec ≈ 245 days)
   
• Impractical execution: Even with physical access to your card, months of effort, and expensive lab equipment, the attack is designed to fail. The very process used would physically destroy the chip, rendering the card useless and making this an impossible strategy for thieves.

We value security research that pushes the industry forward. However, it's crucial to distinguish between lab experiments and practical security risks. The Donjon report highlights an impractical scenario, not a viable threat.

The security architecture of your Tangem card is proven and reliable, giving you uncompromising, physical control over your digital assets. As always, we encourage you to use a strong access code and keep your card physically secure.
 

Frequently Asked Questions (FAQ)

Can attackers steal my private keys? 

No. The reported techniques are focused on guessing the access code, not extracting private keys. Your private keys remain secure on the chip.

Are Tangem cards safe for everyday use? 

Yes, absolutely. This lab-based scenario is not a practical threat. The attack would require months of effort with expensive equipment and would destroy the chip before succeeding. Your funds are safe.

Will Tangem be changing its access code policy? 

No. We are confident our policy strikes the right balance between security and user experience. Even our minimum requirement is more than sufficient against this theoretical attack. For added peace of mind, a longer access code is always a great option.