Tangem replaces the seed phrase with two or three NFC cards holding the same key. We set up a card, tested the tap-to-sign flow, and read through the laser fault-injection disclosure that Ledger's own research lab published against it in July 2026.
Setting up Tangem took us under two minutes: tap a card to a phone, generate a key inside the chip, tap a second card to clone it, done. No twelve words to copy onto paper, no photo of a recovery sheet sitting in a cloud backup somewhere. That speed is the entire pitch, and it is also the risk.
What "seedless" actually means
Most hardware wallets generate a seed phrase and expect you to write it down as a backup outside the device. Tangem skips that step. The private key is generated once, inside a Samsung secure element certified to EAL6+, a level that requires semi-formal design verification and structured testing against physical tampering. That key never leaves the chip in readable form, and Tangem says it cannot be extracted by the companion app or by Tangem itself.
Backup works differently too. Buy a 2-card set for $59.90 and the second card holds a clone of the same key, created over encrypted NFC during setup. Buy the 3-card set for $69.90 and you get a third copy to store somewhere separate again, a parent's house, a safe deposit box, anywhere the first two are not. Losing one card is a non-event. Losing all of them, with no seed phrase written anywhere, is unrecoverable by design.
The July 2026 laser attack, and what it does not change
Ledger's own research group, Donjon, disclosed a laser fault-injection attack against Tangem's secure element on July 9, 2026. A precisely aimed pulse can reset a card's access code by interrupting its recovery-state check mid-operation, after which an attacker who already has the card can sign transactions freely. Tangem confirmed the lab scenario but disputed that it threatens everyday users, since the attack needs the physical card in hand, specialized equipment, and hours of work per unit; it is not something that happens over Wi-Fi or through a malicious app.
