Coldcard vs. Tangem

The distinction matters because “offline device” and “air-gapped workflow” answer different questions. Tangem keeps the private key inside the secure element while the phone constructs the transaction, displays its details, sends it to the card, and receives the signature. The phone cannot directly copy the key during normal operation. That is a meaningful hardware boundary.

But the card cannot independently tell you what it is signing. A compromised or deceptive phone interface can show the wrong asset, network, contract, amount, or destination. The NFC card receives structured transaction data, not the user's intent. For a large transfer, Tangem users should verify the destination through a separate channel and send a small test first.

Coldcard treats the live host session as optional. The Q can scan and return QR-encoded PSBTs. Both Q and Mk5 can move PSBT files by MicroSD. The signer still parses untrusted data, so offline transport does not solve malicious firmware, parser bugs, or a user approving the wrong destination. It removes the persistent phone-to-signer session and gives the user an independent device screen for the final check.

Tangem's NFC-first design is faster and more pocketable. Coldcard's offline PSBT design asks for more deliberate steps in exchange for a different verification boundary.

In Tangem's seedless mode, the first card generates a private key in its chip. During the one-time backup process, an encrypted device-to-device channel copies that key to one or two additional Tangem cards or rings. Every device is equivalent. Any one of them can sign after it is unlocked.

This design removes written seed words from the normal setup. It also makes the surviving Tangem set the recovery material. Lose every device and the wallet cannot be recreated. A two-card set is less expensive, while three devices give more room for a lost card and access-code recovery.

Tangem also supports a BIP-39 path. The phone app can generate 12 or 24 words or import 12, 15, 18, 21, or 24 words. Passphrases are supported on import. That improves recovery portability, but the phone app processes the seed and passphrase during setup. A seed-based Tangem wallet also requires accurate records of networks, token contracts, accounts, and derivation paths; the words alone do not tell a future user which stablecoin contract or chain held a balance.

Coldcard generates and displays its seed on the signing device. It can create encrypted MicroSD backups, derive BIP-85 children, split a seed with Seed XOR, and keep temporary seeds in Seed Vault. Those options are powerful, but they create more decisions. Recovery remains the user's job, and every extra backup must be documented and tested.

Neither model wins every failure scenario. Tangem seedless setup reduces phrase-handling mistakes but depends on surviving hardware. Coldcard's standard seed is portable but must be protected from both loss and theft.

The Donjon disclosure says the attack affects cards currently in circulation, still works when access-code recovery is disabled, and cannot be patched because Tangem firmware has no update mechanism. The researchers reproduced it on three cards. Once they had characterized the chip, each reproduction required about two hours of preparation and exploitation.

This is not a remote attack. It requires physical possession of one card, cutting the card open, exposing and rewiring the chip, advanced hardware-security skill, and a specialized laboratory setup Donjon valued at about $250,000. The preparation is invasive and visible. Donjon's practical warning is about a lost, stolen, or seized card, not an attacker reaching a wallet over the internet.

Tangem's response argues that the cost, expertise, destructive preparation, unknown wallet value, and low scalability make the risk to everyday users “virtually non-existent.” The Block's report summarizes both positions.

Both points belong in the threat model. A random card thief is unlikely to have a fault-injection lab. A targeted holder protecting a large known balance should still care that one stolen card has a demonstrated, unpatchable path around the access code.

If a valuable Tangem card is stolen or seized and the owner may be identifiable, use a surviving device to move every asset to a new wallet. Restoring the old key onto replacement cards does not revoke the missing card's authority. A strong access code remains useful against ordinary unauthorized use, but it does not stop this laboratory path.