Is Tangem safe? What its terms and incident record say
Is Tangem safe?
Tangem's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. 2 primary-source incidents are recorded. Its terms name no gambling rule. Liability is excluded for all loss. This answer reads documents; no code audit or test transaction was run.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with Tangem and earns nothing if you install it. Every statement below is read from a document Tangem publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
Tangem review: the documents
This is a review of the documents Tangem publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is Tangem AG; on jurisdiction the record says: Switzerland. The custody position comes from the Tangem Terms of Service (Official Mobile Application), last updated 14 September 2026, read 2026-10-07. The record quotes 10 clauses across 7 topics, and 5 sub-service clauses where the app hands a swap, purchase or staking to another party. Tangem's terms place the keys with you and disclaim access to them. No cloud or hosted backup is offered; recovery depends on the copy you keep. 2 clauses let the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is excluded for all loss. Its terms name no gambling rule. 6 points could not be verified and are listed below.
Has Tangem been hacked?
2 incidents are recorded, each from a primary source: a disclosure by the company, a public vulnerability register or a regulator. The descriptions are the record’s, unedited, with the date and the source.
Tangem's response to research by Ledger Donjon, which in a lab setting bypassed the time delays protecting against incorrect access-code attempts on a Tangem card. Tangem describes the risk as hypothetical and not exploitable in practice, and states it will not change its policy. No loss of funds is reported.
In a controlled lab setting, Donjon's researchers used specialized equipment to bypass the standard time delays that protect against incorrect access code attempts.
Tangem disclosed that, when a wallet was activated with a seed phrase, by generating or importing one, the private key was written to the mobile app's logs. Fixed in app version 5.19.1 on the App Store and 5.19.2 on Google Play. Tangem stated fewer than 0.1 percent of users could be affected, that no private keys were compromised and no funds lost, that it deleted all logs and attachments containing the data, and advised affected users to move funds, reset the wallet and reactivate it.
No private keys were compromised, no user funds were lost, and no accounts were accessed.
An incident on this list is a disclosed event, not a verdict on the product today. The absence of other incidents is not proof that none happened.
Tangem support and scams
The official domain in the record is tangem.com. The help pages this register read include Tangem help centre, private key security and Tangem help centre, privacy. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What Tangem stores, by the record: Nothing by Tangem, by the terms. Recovery is by linking additional Tangem cards or rings as backup devices, or by a seed phrase where the user chose seed-phrase activation.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like tangem.com, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Tangem nor against it.
- Key storage and recovery for the Tangem Mobile Wallet, the software wallet without a card, including whether it offers a cloud backup. The help-centre key-security article excludes it.
- Named swap providers and staking validators. The terms name none; only MoonPay (privacy policy) and Polymarket (terms) are named counterparties.
- The default node or RPC providers the app uses and what they see. Tangem's help centre says Tangem has no servers connected to blockchains, which implies third-party nodes; none is named.
- The card generations and firmware affected by the Ledger Donjon finding. Tangem's post does not specify, and the Donjon report was not read.
- Per-device network support. The chain list comes from a Tangem blog post, not a support matrix.
- Whether the Tangem Pay card product is governed by these terms. Tangem Pay is not mentioned in the Terms of Service retrieved; its tariff document was found but not read.
Sources
- Tangem Terms of Service (Official Mobile Application), last updated 14 September 2026
- Tangem Privacy Policy, last updated 11 April 2025
- Tangem contacts page, legal entity and document links
- Tangem help centre, private key security
- Tangem help centre, privacy
- Tangem blog, supported cryptocurrencies
- Tangem blog, Tangem Identifies and Resolves Potential Vulnerability, 31 December 2024
- Tangem blog, response to the Ledger Donjon report, 17 September 2025