Cryptocurrency wallet provider Tangem recently addressed a significant security flaw in its mobile application that risked revealing users’ private keys via email. The issue came to light following discussions on Reddit, where users accused Tangem of endangering investors’ funds by potentially exposing private keys both through email accounts and to Tangem employees. A Redditor under the handle u/areklanga criticized Tangem for not adequately responding to earlier warnings.
The vulnerability became widely discussed on December 29, with claims that user private keys were logged within the app and accessible through interactions with Tangem’s support team. Accusations also surfaced that initial reports of this glitch on Reddit were inexplicably deleted.
Tangem acknowledged the issue on December 30, stating it originated from a bug in the app’s log processing but assured users that it had been “fully resolved.” To reassure stakeholders, Tangem explained the incidents occurred when the wallet’s private key was inadvertently stored in application logs. These logs, accessible during customer support interactions, have since been deleted to ensure data security.
The company admitted the issue likely affected a limited number of users who generated seed phrases and then immediately sought support via the app. To prevent further leaks, Tangem urged all users to update their apps immediately. Despite issuing a fix and proactively contacting those affected, Tangem’s perceived subdued response drew criticism from the crypto community. Tangem has not yet made formal announcements regarding the issue on its social media platforms, such as Twitter, Discord, or Telegram, as of December 31.
