Tangem Wallet security, features, and a live crypto transfer demonstrated on a charity livestream
Rob from Digital Asset News interviews David from Tangem Wallet about hardware wallet security, recent hacking attempts, new product features, and best practices for protecting crypto assets.
Summary
Rob and David cover Tangem Wallet's security architecture in depth, including how private keys are generated and stored entirely within the card's microprocessor, never exposed in readable format. David describes two attempts by a competitor to crack the Tangem Wallet — one using a power-manipulation brute force method and another using $250,000 worth of laser injection equipment across at least seven cards — both of which failed to extract any assets. The conversation also covers new Tangem features including a Visa-integrated debit card with its own ACH and wire account numbers for US users, a smart gas function that eliminates the need for layer-one tokens to pay gas fees, and staking support for several networks with more in development. The episode includes a live BNB transfer between Rob and David to demonstrate the wallet's ease of use, conducted during a charity fundraiser for an animal shelter.
Key Takeaways
FULL TRANSCRIPT
DeFi hacks and the importance of burner wallets
David: We have to divide between hacks on platforms, or directly on wallets or on the technology, and hacks on DeFi applications. Nine out of ten — or 9.9 out of ten — cases when it comes to the wonderful world of DeFi, it's people's fault that they get hacked. They were going to put their seed phrase into some other trusted entity. They're going to sign a malicious contract. They had a wallet drain. They act carelessly with their data.
I don't know if we ever spoke about that, but I use ten Tangem wallets — nine with funds on them and one as a burner wallet. So every time I'm going to do something when it comes to DeFi applications — claim some airdrops, use my voting rights, connect with WalletConnect somewhere — I did it the first time. I put some assets for staking. I just transfer the assets I need from my hodl wallets to my burner wallet, where there are only a few dollars' worth of gas fees on it, and then interact with a smart contract.
This is something very crucial. Just imagine you have all your savings — every dollar you've earned — not in your bank account but in your physical wallet, in paper or coins, and you put it in your pocket and go to Central Park at midnight. If you get robbed, that's stupid. And it's the same if you have your hodl wallet with all your XRP, your Bitcoin, your Ethereum on it and you just use a DeFi application. You can get a wallet drain within seconds and there's nothing you can do anymore.
So this is one topic we really highly recommend: just use burner wallets. It could be a MetaMask, it could be an Exodus wallet, it could be anything — but we definitely need to make sure it's not the wallet where you have all your savings. We as Tangem also integrated a new feature a couple of months ago that checks smart contracts before you sign them and translates them into real, readable code. We'll come to that a little bit later. We definitely need to help our clients not get robbed. That's very crucial for us.
Open source, the ColdCard incident, and Tangem's bug bounty program
And let's come to the other side. We couldn't do anything when it comes to wallet hacks or exchange hacks. We highly recommend getting your assets off the exchange and into your hardware wallet. But let's take the ColdCard case, which is pretty sad. That was also an issue created by humans, and I totally hate that — because if they had put their code completely open source, the community could take a look into it and check it. Tangem is open source, as it has to be. The community can look into it, and we also have a bug bounty program and a white hat hacker program where we pay the community and white hat hackers to check our code. We really do this because you can check as much as you want, but in the end you're human. If you put a second pair of eyes on it, that's good — but if you put 500 other pairs of eyes on the code, that's just the best.
How Tangem generates and protects private keys
So let me end with what separates Tangem from every other hardware wallet. When you create your Tangem wallet for the very first time and set it up, you have two options. You can create your wallet starting with a seedless version. What happens is the microprocessor on the card directly creates the private key without the private key ever leaving the card to the phone. There is never anything in readable format — it is all created at the very highest entropy by the processor itself. There is nothing that could hack that. We have 256-bit encryption with that, which is again the highest entropy level we can get.
But if you choose to have your seed phrase — because you were told to during the last 17 years and you need to write it down or feel better about it — that's fine. You can do that. There are two additional ways. You can put in your own seed phrase, ideally 24 words plus a passphrase — an additional layer that creates the highest entropy possible. Make sure you put your passphrase in. It doesn't matter how long it is. This is nothing that someone can reverse-engineer, even when it comes to quantum computing.
Or you can let the Tangem app create your seed phrase. That sometimes seems a little odd when I talk to people, because they say, "You really want your phone to create your seed phrase and know it?" Yes. The Tangem app is a complete island. It doesn't ask for anything in your phone and it doesn't send anything out. When it comes to creating the seed phrase, I highly recommend 24 words. It doesn't come from a pre-fabricated list, which is pretty interesting. The app uses the noise from the processor in your smartphone to create the highest level of entropy — and I apologise, you may recognise I'm German, not a native English speaker — to create the 256-bit encryption and again the highest entropy. So nothing can happen there either.
Again, it all comes down to the user. If you write down your seed phrase somewhere someone can find it, that's the risk. If you use only 12 words, it's still safe — don't worry, it's still a high level. But 24 words plus a passphrase is always the very best. That's what we highly recommend.
Rob's personal Tangem setup and the two-card system
Rob: You know, a passphrase is great — the 25th word is whatever you want to make it. You can use the mnemonic phrase, you can generate those 24 words. But I've got to be honest with everybody here: I don't use those for Tangem. What I do is, as it sets up, I don't actually record anything. I don't write anything down. I move around a lot and I'm always paranoid, and so far what has worked for me really well — even with the new cards we just set up for the animal shelter — is you're essentially just scanning these cards and everything is within the card.
People would say, "But Rob, what happens when someone steals your phone? You're screwed." No, it doesn't work like that. First of all, if my phone gets taken, they need a physical card. And let's say they're not that smart and they kept the Tangem card with the phone — they still won't have access, because once they tap that card, they need a PIN code to get through. And if you lose the PIN code or forget it, great news: you have two cards, and if you have two cards you can reset your PIN code and everything works out.
I treat Tangem like Fort Knox. But other people will buy two sets of Tangem — one set they use to pay for things, just scanning and going, and the other is the Fort Knox part. Tangem actually supports that. You can pay for things with one set and keep the other as your secure store. So again, I wouldn't keep my entire life savings in crypto and walk around with it. I would have two different types of cards. David, what did I miss?
Biometric security and what happens when someone accesses your phone
David: I don't think you missed anything. You explained it perfectly. I'm always stunned when I explore new things with Tangem. I came to a point where I told my wife, "Honey, what would happen if I die tomorrow?" And she said, "We'd all be sad, but we probably wouldn't get to the crypto." I said, "You're right. Let me sign up your face ID to my phone." I still don't know if that was a good idea — theoretically I have nothing to hide, but anyway.
I started with her. I said, "Look for the Tangem app and open it. I have my biometrics set up with my iPhone." She opened the Tangem app and it said it wanted to scan her face. Typically when I scan my face, it opens my wallet perfectly fine. So when I open my phone and go to my Tangem app, everything opens up. This is my burner wallet — you can see I've only got a couple of bucks on it. If I scroll to the next one, these are my regular wallets with assets on them. Anyway, I have two phones.
Once I added her face, Tangem would not open the app without notifying me: "There is a new face, a new ID added to your phone. Please scan every single card you have on the phone and enter the PIN, so we know you're the owner." And that was something where I said, "Okay, you guys really took it to the next level." Even if someone steals your phone, social-engineers their way in, and adds a new face, Tangem knows — please be careful. This totally stuns me.
It doesn't matter if you lose the phone. It doesn't matter if you lose one card. It doesn't matter if you lose one card and the phone together. They will never ever get access. And even if they can break in, Tangem will recognise it and ask for the PIN. If the PIN is at least eight digits long, there is no way to brute force it. And if you try to brute force the PIN, after the fourth wrong attempt it increases the time between entries — eventually you're waiting five minutes, ten minutes, half an hour. There is no way to brute force it.
The $250,000 hacking attempt — and why it failed
Rob: That's a good point. We hear about brute force attacks and how with AI and quantum computing they can just go and go and go. But if you force a shutdown and an expansion of time between brute force attempts, that's pretty great. And then of course, screw up enough times and —
David: Let me add something to that. We have a really good competitor — you've named them already, they came from France — and they invested a lot of time, effort, and money to try to hack the Tangem wallet. They started last year with a brute force attack where they opened up a card and tried to manipulate the processor by giving power to it and releasing it at the right time to bypass the brute force time delay. They made it work — but the interesting fact they never told anyone is that the internal memory of our microprocessor is programmed as a control door. If you overpower it, which happens pretty quickly after the third or fourth time you give power to it and pull it back in an imprecise way, it totally destroys the processor and nothing can ever happen with it.
They never told anyone they extracted assets, because they never could — they never did. But they made a proof of concept. Then about two months ago, I think, there was another case where they tried a laser injection procedure — essentially erroring the processor at the right time — with $250,000 worth of equipment. They opened up and destroyed at least seven cards until they came to a point where they could manipulate one.
Long story short, they invested a lot of time and helped us make our product better. If you need a laboratory with skilled employees costing at least half a million a year, plus equipment worth a quarter million — what are we talking about? It's good. We learned from it. Thank you for that. But there is no real danger.
Rob: I saw those reports and those posts, and I took a look and scanned through them. You're telling me I'm going to have to have the physical cards, all of them, $250,000 worth of equipment, know what I'm doing, and have access to all of those things simultaneously. It could happen — but I don't see it happening anytime soon. This is why we talk about diversification. We diversify our portfolio, we diversify our storage, we spread things around. Only the paranoid survive. If you've got a big chunk of holdings, why not move things around a little bit.
Live BNB transfer demonstration
Rob: David, are you able to send any crypto anywhere right now?
David: Yeah.
Rob: Great. Let's do it. Let's show people how easy this is.
David: What do you like? We're in Europe here — the EU doesn't like USDT, but what do you think? BNB? Give me a BNB address.
Rob: BNB Smart Chain. Gotcha. Let me put this into the private chat. Actually, can you look up a QR code and scan it? That might be easier to display.
David: Yeah, that's probably better. Let me switch to my BNB assets. I think that's a great idea — it really displays a use case. Okay, so I'm going to press Transfer, then Send, then choose the amount. I said 0.4 — that's roughly $250. I'll say Next, then Scan. Can you display the QR code again? Okay, let me scan it. Got it. Let me check the first digits — 8DFC, something in the middle, 9F. Okay, perfect. Looks good. I'll say Next. I'll check it again. Network fee is below one cent. Just imagine four years ago — even with Ethereum, that wasn't possible. I'm going to do my face scan. And now I'm going to tap my Tangem card. This is one of the old versions, which was seedless only. These are the new versions with seed phrases. And it's sent.
Rob: It'll probably update in a moment. I used Claude to set up scanners for Bitcoin, Ethereum, and BNB that update every two to three minutes, so it'll come in. But a lot of the time it's there within ten to twenty seconds.
David: Exactly. And that's the beauty of digital assets and crypto. We just did that. Try doing that with your bank account.
New Tangem features: Tangem Pay, bank accounts, and smart gas
Rob: David, that leads us into the last question. What are you guys working on in the background? Is there anything new coming out?
David: Let me go back a little bit to what we've already done, because I think that's absolutely important. Specifically for the United States — I think you've noticed that we've brought up Tangem Pay. That's our Tangem debit card. We integrated Visa directly into the Tangem user interface and made sure you can have a lot of fun with it. What we've done recently is you can now have more than one Tangem Pay card — you can apply for a second, a third. You can also apply for a physical card. We've also brought in benefits like airport lounges, cash back, and so on. Check out our website. We're really becoming more of a seamless solution when it comes to money, and we're really proud of that.
What we've also done, which is very interesting, is we now have account numbers for ACH and Fedwire deposits for qualified users. So you get your own bank account with Tangem.
Rob: Hold on. Wait. So you get a bank account — and I'm going to guess this is not in America?
David: No, it is. It's live only for America. That's funny. We're really looking forward to getting that in Europe, but the guys here are driving us crazy with all the MiCA stuff and trying to regulate everything to the bottom. Horrible.
Rob: Wow. That's a total reversal. So you have to do KYC and AML — submit your information, your photos?
David: What's very important to understand: if you apply for Tangem Pay, you do that in the app because we share part of our app with Visa to use the interface. But what does not happen is this: the KYC process for the Visa Tangem Pay card does not get linked with your hardware wallet. Your hardware wallet stays as a hardware wallet — anonymous, without any information linked to you. Your data, your information, your money — it doesn't matter. It's still a hardware wallet and nobody knows who owns it. Your Visa Pay card is your Visa Pay card. That's very important. I know sometimes people go crazy and say, "Oh no, now everybody knows who I am with my wallet." No, that's not the case.
Rob: Separate walled gardens. I like it.
Staking and the smart gas feature
David, the other thing — before I forget — is staking. What do you guys offer for staking in your cold storage wallets right now, and what are you working on for the future?
David: Live right now we have Solana, Cardano, Tron, Cosmos — so Atom — and Polygon, so Matic. That's what we have. We're working on several other options. We know XRP is definitely needed. We know something for Ethereum is highly needed. We know something natively for Bitcoin is highly needed. But here's the point: we at Tangem have the highest responsibility to select the right partners for the right job, with the highest level of trust. If we don't do that, we'll definitely have an issue with trust, and we don't want that. So yes, it takes longer to implement new partners, but this is your money. If something goes wrong, it's not the staking provider everyone will blame — it's Tangem. So we really separate and check everything in very fine detail.
Something I need to highlight — even with staking — is our smart gas function. I don't know if you've noticed this. We've implemented it for different networks like Ethereum, BNB, and Matic, so that you no longer need the layer-one token for gas fees. Let's imagine you want to send USDT on the Ethereum network. You can just send it without having ETH as a gas fee.
Rob: What?
David: The gas fee is taken from your USDT. Same for Polygon and Matic. Just imagine — four years ago, eight years ago, we had to have $150 worth of ETH to send $500 in USDT. The gas fee is much lower now, but how many times did you stop sending assets because you were missing the layer-one asset or didn't have enough to pay the gas fee? New users coming into the market right now using Tangem don't even recognise this as a problem, but everyone who's been here at least four years knows what a pain that was.
We're also very proud of a complete rework of our interface — everything is very clear and smooth. We've added token information, all the details for tokenomics. Theoretically, you don't need to leave the Tangem app to get all the information you need to stay updated.
Tangem's security record
Rob: David, how many times have you guys been hacked?
David: Zero.
Rob: Okay, just making sure.
David: Except for the two times the French guys tried it. But again, that was a proof of concept. I definitely said — please, take a wallet with fifty bucks on it and extract it.
Rob: See what happens. Well said.
Closing conversation — pets, the charity fundraiser, and Tangem wallet giveaway
Hey David, I've been taking so much of your time. I appreciate it. We'll wrap up unless there's something big you wanted to disclose. But the last question is a very simple one: do you have any dogs, cats, parakeets, any pets?
David: Unfortunately, not anymore. We buried our fifteen-year-old Jack Russell — a lady who really grew up with my four daughters — unfortunately three or four months ago. It broke our hearts honestly. But my oldest daughter got a four-year-old show jumping horse. So we have 600 kilos of raw meat sitting there. Yes, we have a pet horse.
Rob: David, I feel your pain. I had two dogs — one lived to thirteen and one to fourteen — and they essentially grow with you through a cycle. It is difficult when you lose them. I understand your pain. I'm glad your daughter got a jumping horse. That's great.
I will say that if you don't have a dog, they're the greatest things of all time. They never rugpull. They never sell you some crazy meme coin. They don't go back on business deals. They're fantastic. And as a reminder — as we're going through this charity event and you know David donated — if you guys want to donate, we always get around ten to twenty thousand views per video. We're looking at a goal of $200,000. If you guys can pitch in twenty or forty bucks, we're able to actually move into our new location, as we lost the lease for our current location. We'll be moving fifty to seventy dogs. The donations go toward setup, canisters, water, engineering, the crew, and solar panels so we can have electricity 24/7.
David, again, thank you for stopping by. We appreciate it, especially for all those new updates. Some things I had no idea you guys were doing — I need to keep myself up to date.
David: We're working on so many other things. Unfortunately I couldn't tell you all of it — they'd spank my butt and I don't want to risk that. Stay tuned. It's very important.
And make sure whenever you come to any social media channels — Telegram, Discord, or even YouTube comments — don't trust anyone who asks you for information, tells you to transfer assets, asks you to sign a contract, or asks you to log in somewhere or give them your information. If somebody tries to put you in a hurry, stop, think about it, ask someone, and that's all I can tell you.
Rob, if I had known that was really just a test transaction to show how quick it was, I would have donated more. Let me do that a little bit later. I can also offer five Tangem wallets — you can give them to the highest donors or the next donations above a certain amount, you choose. We'll take five wallets, you give us the addresses, and I'll make sure they get them no matter where in the world. We're more than happy to do that as our part as Tangem.
Rob: You're the best. David, you guys are the best. I love it.