TODAY’S SHORT THREAD ON TANGEM. "Tangem appeals to the lowest common denominator in the crypto world, which is why it’s full of $XRP, $KAS bagholders and paid affiliates shilling with peanuts. Today, I’ll keep it simple so people understand. In December 2024, @Tangem had a critical vulnerability where its mobile app wrote users’ PRIVATE KEYS to logs attached to support emails. They deleted early warning posts on Reddit. Before you say 'muh no seeds, muh secure,' yes, your keys never touch the app. Your TRANSACTIONS do—every single damn time. The attack vector is THE APP ITSELF and the OS it runs on. Keep reading. Tangem’s Nirvana Fallacy: seatbelts have occasionally failed, so let’s remove them entirely. Clear-signing flaw in Ledger/Trezor: in the worst case, the screen lies about transaction parameters. Tangem’s design: the screen (on your phone) can lie about transactions as a baseline permanent condition. >"Hardware Implant" Hardware implants predate Bitcoin. They’re device-agnostic. The phone running the Tangem app could also have an implant—so what? The "Tangem Genuine Check" was already exploited by Ledger. Fake Tangem cards aren’t theoretical: https://t.co/weL2RZwpWw >"Clear-Signing Flaws" Clear-signing flaws are a failure of a layer that Tangem doesn’t even have. Tangem signs any payload the app passes to it—every time—by design. Car airbags have defects—even Toyota’s, the most reliable car manufacturer in existence. Tangem’s solution is to remove airbags entirely. Ledger and Trezor vulnerabilities are routinely patched. You’ll never be able to patch your laser vector: https://t.co/bu4FLwrKNM Zero tear vector: https://t.co/oIev1NIF3A... because there’s no update channel for users. Your security page still advertises resistance to "fault injection attempts." Donjon’s laser attack IS fault injection. It works—and it’s irreparable by you. [Eureka Moment] The clear-signing flaws at @Ledger and @Trezor were discoverable BECAUSE the trusted screen can audit against what is signed. In Tangem’s model, there’s nothing to audit. Read that again slowly—it’s easy to miss. It’s evidence that the architecture is testable. Ledger/Trezor is like a bank that publishes audited accounts. Occasionally, an auditor will find an error: 1. Builds a transaction. 2. Records what the device displays. 3. Records what the device actually signs (the signature reveals exactly what was signed). 4. Compares the two. Tangem is a bank that doesn’t keep books. Therefore, no accounting error will ever be found: 1. Builds a transaction. 2. Records what the app displays. 3. Records what the card signs. 4. They differ: the app showed one address, the card signed another. In Tangem’s case, there’s no vulnerability because Tangem never promised those two things should match. The card signs whatever payload the app sends it. This is exactly how the system is designed—and it’s the default behavior for a compromised OS. >"More hardware components introduce more attack vectors." So your solution to a purpose-built, minimal-firmware-driven trusted screen (Ledger/Trezor) is a damn smartphone running a full OS with millions of lines of code and countless attack vectors. Great. >"muh hardened app" You never responded to my original post here because you can’t: https://t.co/MG6h64o3sE Tangem was also audited by Riscure in 2023—yet you still got pwned by Ledger: https://t.co/L6jOc2g67C Not even Apple or Google can defend an app against a kernel-level exploit on their own OS—that’s why Ledger/Trezor don’t try. They verify OUTSIDE the blast radius. Your "hardened app" lives inside it. [Latest Exploits] Watch the attached videos—there are many more I didn’t include. You don’t have the money, resources, or expertise to defend against OS exploits. How many of your users are even using Pixel 8 or later, or iPhone 17 or later? That matters too. Your "app" layer is dead on arrival. Ledger & Trezor provide mitigation where you cannot. Tangem is more akin to a software wallet because it implicitly trusts a compromised OS. The secure element is theater—the card will sign anything you send it." https://t.co/2rdNCI7JiG