Laser Fault Injection Defeats Password Check on Unpatchable Tangem S3D232A Cards

Ledger Donjon demonstrated the attack on multiple Tangem cards after decapping and mapping the EAL6+ chip. The fault targets the single conditional check that decides whether SetPin accepts a new value without prior authentication. Once tuned, success occurred on every tested card in roughly two hours. No firmware exists to alter because Tangem cards ship immutable by design.

Procurement records and certification listings show the same Samsung part appears in other payment and access tokens. The attack surface is therefore not Tangem-specific; it is any device whose password-reset logic runs inside an unupdatable secure element whose silicon can be reached. Tangem correctly notes the $250,000 lab cost and visible card damage, yet the method remains available to any party already holding the physical token.

Official statements emphasize low practical risk for current owners. Independent technical reporting confirms the flaw is permanent and present on every card shipped to date. The pattern matches prior physical attacks on certified chips where economic deterrence, not technical mitigation, is the remaining control.

Owners of high-value lost or stolen cards face the only near-term exposure. Future procurement decisions by exchanges and custodians will likely require explicit language on firmware mutability and documented resistance to fault injection beyond EAL6+ claims.