Tangem Fixes Bug Exposing User Seed Phrases via Email, Faces Criticism Over Response
Tangem, a cryptocurrency wallet provider, has fixed a critical security vulnerability in its mobile app that risked exposing users’ private keys through email communications. The issue was identified after Reddit users pointed out that the bug had compromised users’ seed phrases, which were stored in email histories, potentially allowing access by Tangem employees.
Key Details:
Security Flaw: The bug was related to the app’s log processing, which mistakenly logged private keys when users created a wallet with a seed phrase. These logs could then be accessed during interactions with Tangem’s support team.
Scope of the Issue: Tangem confirmed that the vulnerability affected less than 0.1% of users, specifically those who created a wallet with a seed phrase and submitted a support request within seven days of activation. Users who did not use a seed phrase or did not contact support were unaffected.
User Communication: Tangem stated that no private keys were compromised, no user funds were lost, and there was no unauthorized access. The company also assured that all logs and attachments sent to support were permanently deleted.
User Reaction:
Criticism of Response: While Tangem quickly released an update to fix the issue on Dec. 30, some members of the crypto community criticized the company for its muted response. Users claimed that Tangem’s reaction was insufficient, with some pointing out that an earlier Reddit post discussing the issue had been deleted.
Lack of Public Announcement: As of Dec. 31, Tangem had not made any announcements through its social media channels such as Twitter, Discord, or Telegram, further fueling criticisms of its handling of the situation.
Tangem’s Actions:
Bug Fix and Security Updates: The company has implemented additional security measures, including enhanced protocols, a proactive outreach program to notify affected users, and a bug bounty program to identify vulnerabilities and reward those who report them.
User Updates: Tangem advises all users to immediately update their mobile applications to prevent further exposure of seed phrases.
Tangem’s response to this security flaw has been a subject of debate in the crypto community, with some praising the company for its quick fix, while others feel that the situation was downplayed. The company has assured that no funds were at risk, but users are urged to remain vigilant and take the necessary steps to safeguard their wallets.
