Security Risks Plagued Tangem Users

Crypto wallet provider Tangem recently addressed a critical security flaw in its mobile app that inadvertently exposed users' private keys during email interactions with customer support.

The vulnerability, first brought to light in a Reddit post by user "u/areklanga" on 29 December, revealed that private keys were being stored in email histories, potentially accessible to Tangem employees.

The user stated:

“So, user private keys remain in both user email history, Tangem email history, and perhaps in some Tangem ticket tracking system and are available for Tangen employees. Which makes all Tangem users compromised.”

Following intense scrutiny from the community, Tangem acknowledged the issue on 30 December, attributing it to a bug in the app's log processing function.

The company assured users that the bug had been "fully resolved" and emphasized its limited scope, affecting only those who generated a seed phrase and immediately contacted support.

Tangem said in a statement on Reddit:

“When creating a wallet with a seed phrase, the private key was mistakenly logged in the application's logs. These logs could later be accessed during interactions with our support team.”

Tangem also confirmed that all affected logs had been deleted.

While the swift resolution offers some reassurance, the incident has ignited broader concerns about security practices and transparency within the crypto wallet space, challenging Tangem to rebuild trust among its users.

Tangem Downplaying the Situation According to Users

Despite Tangem's swift action to resolve the security vulnerability, concerns have emerged within the crypto community about the company's approach to communication.

Critics pointed to the absence of public announcements on Tangem's official social media channels, leaving many users unaware of the issue.

One Reddit user noted:

“I find it frustrating how Tangem is downplaying the scope of this event. While they claim that only a "very small group of users" sent an email with their keys, how many users had their keys written in plain text to their phones in a log file?”

As of now, Tangem has yet to issue a formal statement on its social platforms regarding the incident.

However, they did respond to a user's comment on X (formerly known as Twitter).

In the meantime, the company has urged users to update their mobile apps to the latest version to ensure protection against the identified risk.

The situation raises important questions about the balance between transparency and timely action in maintaining trust within the crypto space.