The Physics of Tangem’s Secure Element: Why Fault Injection Attacks Cannot Extract Keys from Embedded Chips

A cryptocurrency holder has a practical concern: a hardware wallet is only useful if its private keys remain inaccessible to attackers, even when the device is stolen, disassembled, or subjected to deliberate physical attacks in a laboratory. The standard threats to embedded cryptography are well-documented. Voltage glitching can introduce computational errors that leak secrets through observable faults. Electromagnetic probing can measure fluctuating fields around a processor to infer cryptographic operations. Thermal imaging and power analysis can reveal algorithm patterns through temperature and current consumption. These attack classes have succeeded against poorly designed chips in industry labs and have motivated a generation of security engineering specifically designed to defeat them.

Tangem’s architecture addresses these threats by moving all cryptographic operations into a hardened secure element—a specialized chip built with multiple protective layers that make such attacks economically impractical or physically impossible. The secure element is not simply a compartment that happens to be harder to access. It is a discrete piece of silicon with its own power distribution, clock signals, memory hierarchy, and instruction execution pipeline, all designed under explicit threat models that account for voltage manipulation, electromagnetic radiation, and invasive probing. Understanding how these defenses work reveals why a stolen card or ring cannot leak private keys simply because an attacker has physical access to the device.

Why voltage glitching fails against hardened chips

A voltage glitch is a momentary dip or spike in the power supply to a processor, typically induced by applying a needle probe to a power pin or nearby trace, or by creating a sharp pulse in an external field. If timed correctly during a cryptographic operation, a glitch can cause a processor to skip instructions, execute incorrect calculations, or write corrupted data to memory. An attacker observing the output can then infer what should have been computed, extracting information about the key used in the calculation. This attack class, known as fault injection, has been demonstrated against microcontrollers, smart cards, and even some enterprise security modules when defenses were weak.

Secure elements designed to resist glitching employ several physical countermeasures. The first is power filtering: the secure element has its own onboard voltage regulators and decoupling capacitors that stabilize the power supply locally, regardless of external fluctuations. A well-designed regulator can respond to sudden load changes or external noise in microseconds, maintaining stable voltage across the chip. An attacker attempting to induce a glitch must overcome this self-contained power management system, which means the attack probe must inject current directly onto the chip’s internal power rails—a far more difficult proposition than attacking an external connector.

The second countermeasure is temporal redundancy and result verification. Instead of performing a cryptographic operation once and trusting the result, a hardened implementation executes the operation multiple times using different algorithms or representations, then compares the results. A single-point fault typically affects only one execution, causing a mismatch that triggers an error response rather than allowing corrupted output to leave the chip. This approach adds computational cost and latency—elliptic-curve operations might take milliseconds instead of microseconds—but makes it nearly impossible for a transient fault to produce observable external effects without detection.

A third layer is instruction-level monitoring. The processor inside a secure element does not simply execute instructions in a standard fashion. Each instruction can be encoded with error-detecting codes, and the execution pipeline monitors for anomalies such as unexpected instruction sequences, rapid state transitions, or instruction timing that deviates from baseline. If an instruction appears to have been skipped or corrupted, the chip immediately halts and erases its key material. An attacker attempting a glitch attack must not only time the fault injection correctly but also predict how the chip’s protective logic will respond—a far more complex problem than tricking a simpler processor.

Electromagnetic analysis and shielding in the physical layer

Every electronic computation radiates electromagnetic fields. A processor executing a cryptographic operation produces field fluctuations that carry information about the data being processed. An attacker with specialized equipment—a sensitive antenna, spectrum analyzer, and signal processing tools—can measure these emissions and extract information about the key through statistical analysis of the field patterns. This attack, called electromagnetic analysis (EMA) or differential electromagnetic analysis (DEMA), does not require direct access to electrical signals; it can work at distances of centimeters to meters depending on the chip’s design and the equipment used.

Tangem’s secure elements are manufactured with intentional electromagnetic countermeasures built into the silicon itself. The first is electrical isolation: sensitive circuits such as key storage, cryptographic engines, and random-number generators are physically separated from interface circuits that communicate with the outside world. A metal Faraday cage or shielded substrate layer separates these regions, attenuating electromagnetic leakage from internal operations. This shield is not simply a metal coating applied after manufacture; it is integrated into the chip’s design at the metallurgical level, so that breaking through it requires destructive analysis that would also destroy the key material.

The second countermeasure is constant-time execution and power consumption randomization. An operation that takes different amounts of time or power depending on the key material being processed leaks information about that key. To defeat this, cryptographic implementations in hardened chips execute all operations in the same number of cycles and work to keep power consumption constant by ensuring that operations that depend on the key consume similar amounts of energy as operations that do not. If an operation takes variable time, the chip inserts dummy operations to make the total time constant. If power consumption differs, the chip adds dummy memory accesses or arithmetic operations to smooth out the variability.

A third layer is frequency hopping and random jitter. The secure element’s internal clock is not stable; it intentionally varies slightly from cycle to cycle in a pattern determined by a true random-number generator. Electromagnetic emissions are therefore spread across a range of frequencies rather than concentrated at a fundamental frequency and its harmonics. An attacker attempting to measure emissions at a specific frequency or synchronize analysis to the processor’s execution finds that this variation makes statistical analysis far more difficult. The timing variation also makes power analysis less effective, since the relationship between the observable power signal and the internal computation becomes less predictable.

Physical substrate design and invasive attack mitigation

Invasive attacks disassemble the chip or card to access internal layers directly. An attacker with a focused-ion beam (FIB), electron microscope, and chemical etching equipment can remove layers of the chip, probe internal bus lines, and attempt to read or modify memory. These attacks require expensive equipment and significant expertise, but they have succeeded against insufficiently protected designs. A Tangem hardware wallet‘s secure element is designed to make invasive attacks either impossible or detectable before the attacker can extract useful information.

The first line of defense is substrate design. Secure elements are manufactured on a special substrate that includes multiple metal layers, many of which serve no function other than to physically obstruct access to sensitive regions. These dummy metal layers are interlaced in complex, non-standard patterns that make it difficult to predict where internal structures lie. If an attacker removes a metal layer expecting to find a key storage region, they may instead encounter a layer of dummy routing or protective circuitry. The real key storage is buried deeper, behind additional protective layers.

A second countermeasure is mesh structure and tamper detection. The secure element’s substrate contains a dense mesh of conductive lines that run throughout the chip. These lines are connected to a tamper-detection circuit that continuously monitors electrical continuity. If an attacker uses an FIB to cut a line, drill through a layer, or introduce a chemical etchant, the continuity changes, triggering the tamper response. The response is not merely to log an alert; it is to immediately erase the key material through a destructive erasure operation that cannot be interrupted or reversed. Some designs go further, physically destroying sensitive regions through embedded fuses or reactive elements that trigger when tamper sensors detect an anomaly.

A third mechanism is redundancy with entanglement. Key material is not stored in a single location where an attacker might extract it. Instead, it is split across multiple memory regions, sometimes with portions physically separated on the substrate. To reconstruct the key, an attacker must successfully access multiple regions simultaneously or sequentially without triggering the tamper detection. The regions are also entangled through cryptographic operations, so that a partial read does not yield usable key material. For example, different portions of a private key might be XORed together, encrypted with different local keys, or combined through a threshold scheme where no single piece provides information about the complete key.

Side-channel hardening and noise injection

Side-channel attacks infer secrets from the physical properties of how a computation is carried out, rather than from exploiting algorithmic flaws. Power analysis, timing analysis, and electromagnetic analysis are three major side-channel attack families. Countermeasures against side channels are among the most mathematically rigorous and well-studied areas of cryptographic engineering, precisely because these attacks are difficult to patch without hardware redesign.

The secure element implements randomization strategies at multiple levels. Data masking—representing sensitive values using random shares that combine to the actual value—makes it impossible to observe the key directly through power or timing analysis. An operation that appears to correlate with key material actually correlates with a masked version of the key, which is statistically uncorrelated with the real key. An attacker collecting millions of power traces would need to know the masking values to extract the key, and those values are regenerated on every operation from a true random-number generator inside the chip.

Randomized algorithm selection also increases the cost of side-channel attacks. Instead of always executing the same cryptographic algorithm in the same order, the secure element selects from multiple equivalent implementations on each operation. For example, an elliptic-curve point multiplication can be computed using a dozen different algorithms, each with different timing and power profiles. An attacker collecting traces would observe a mixture of profiles, making averaging and statistical analysis far less effective. The algorithm selection is determined by the on-chip random-number generator, so the attacker cannot predict which algorithm will be used on the next operation.

Noise injection adds computational overhead but provides significant protection. The secure element continuously executes dummy cryptographic operations, performs random memory accesses, and generates electrical noise as part of its normal operation. This noise is intentionally uncorrelated with the actual cryptographic operations being performed, so it provides no information to an attacker but significantly reduces the signal-to-noise ratio of any collected measurements. Analyzing power or electromagnetic emissions becomes similar to trying to identify a conversation in a crowded room: the information is theoretically there, but extracting it requires more time and computational resources than the secret is worth.

Key isolation and cryptographic architecture

The secure element’s internal architecture ensures that even if an attacker somehow bypasses all physical countermeasures and gains the ability to read arbitrary memory, the key material itself remains protected. This principle is called defense in depth: no single countermeasure is expected to be perfect, and multiple layers ensure that the loss of any one layer does not compromise the system.

Private keys are never stored in plaintext in the secure element’s memory. They are encrypted at rest using keys derived from an immutable master key that is hardened into the chip during manufacturing. This process, called secure key injection, occurs in a controlled factory environment before the chip is assembled into the card or ring. Once the master key is in place, physical protections ensure that reading it back is impossible. If an attacker obtains encrypted key material, decrypting it requires access to the master key, which they do not have. Even if they destroy the secure element in the process of trying to access the master key, they still possess only encrypted data.

The cryptographic operations that use the key also never expose the key to the main computation. Instead, the secure element implements what is called a cryptographic coprocessor: specialized hardware designed to perform specific operations (such as ECDSA signing or AES encryption) directly on the key without requiring it to be moved into general-purpose memory. An operation request comes in, the operation executes on specialized silicon, and the result exits the chip. The key material remains in isolated, protected memory throughout the operation. An attacker observing the bus lines connecting the coprocessor to memory would see only encrypted or masked values passing through, never the key itself.

Transaction signing—the most frequent operation a cryptocurrency wallet performs—benefits from this architecture. The mobile application on the user’s Android or iOS device never receives the private key. Instead, the application prepares a transaction message, sends it to the secure element via NFC, and the secure element performs the signing operation internally. The signature is returned to the application, which broadcasts it to the blockchain. From the secure element’s perspective, it has received data, performed a computation, and output a result. The key never leaves the chip, regardless of whether the user’s phone is compromised, the mobile application is malicious, or the network connection is monitored.

Manufacturing integrity and supply-chain trust

A hardware wallet’s security depends not only on design but on manufacturing quality. A secure element manufactured by a facility with poor quality control, inadequate cleanroom practices, or insufficient testing could have structural flaws that make it vulnerable to physical attacks. Tangem’s secure elements are manufactured using certified security facilities that follow international standards for hardware security module production.

The manufacturing process includes multiple verification steps. After initial production, samples are subjected to accelerated life testing, electromagnetic susceptibility testing, and fault injection testing to ensure that designs perform as expected under stress. Batches that fail testing are rejected entirely rather than being released in hope that failures are isolated. The manufacturing environment is controlled to eliminate contamination that could weaken the substrate or protective layers.

Post-manufacturing, each secure element undergoes individual testing to verify that its tamper-detection circuits function correctly, that its cryptographic operations produce correct results, and that its random-number generator meets statistical standards. This testing is non-destructive and can be performed before the chip is encapsulated into a card or ring. Only chips that pass all verification steps are released for use.

The supply chain is also protected through verification mechanisms. Legitimate Tangem cards and rings can be verified through on-chip attestations that prove the chip was manufactured by an authorized facility and has not been cloned or modified. This attestation is cryptographically signed using a manufacturer key, so it cannot be forged. A user receiving a physical device can verify its authenticity by checking this attestation, providing confidence that the device contains a genuine secure element rather than a counterfeit chip or a real chip that has been disassembled and reconstructed.

Why extracting keys remains impractical despite physical access

The cumulative effect of these defenses is that extracting private keys from a Tangem secure element requires either extraordinary resources or techniques that would destroy the key material in the process. A casual thief cannot extract keys by opening the card or ring with everyday tools. A sophisticated attacker with laboratory equipment faces exponentially higher costs as each protective layer adds complexity. The combination of electrical hardening, physical substrate design, electromagnetic shielding, tamper detection, side-channel countermeasures, and key isolation means that multiple independent attacks would all need to succeed simultaneously.

Consider a specific attack scenario. An attacker obtains a Tangem card and decides to perform power analysis. They would need to remove the protective encapsulation, which risks damaging the card and triggering tamper detection. They would then need to attach probes to measure power consumption, a process that might trigger additional sensors. Assuming they succeed, they would collect power traces over many operations, but these traces would be contaminated by the noise-injection mechanisms embedded in the chip. They would need to perform statistical analysis to extract the signal, a process requiring thousands or millions of traces. Each trace collection takes time, during which the possibility of triggering tamper detection increases. Even if they collected millions of clean traces, the data masking and randomized algorithm selection would require them to perform additional cryptographic operations to extract the key. The total time and expertise required would likely exceed the value of whatever assets might be protected by the compromised key.

An invasive attack using a focused-ion beam faces similar impediments. An attacker would need to carefully remove layers of the chip to locate key storage regions, a process that destroys the chip but requires predicting where those regions are located among the dummy layers and protective mesh. Once a sensitive region is exposed, the tamper detection mesh responds by triggering an erasure operation. Even if the attacker works quickly, the erasure cycle—which might involve fusing internal components or rewriting memory—makes key recovery impossible. The attacker may succeed in taking the device apart, but the key material itself is destroyed in the process.

Practical security implications for users

The physics of secure elements matter because they establish a security boundary that does not depend on software updates, user behavior, or the integrity of any external service. A user’s private keys are protected by the laws of physics and circuit design, not merely by access control lists or encryption algorithms. This has concrete implications for how users should interact with their hardware wallet.

First, physical possession is not the same as key access. A stolen Tangem card or ring is not equivalent to a stolen recovery phrase. The attacker has the device but not the keys, and extracting the keys from the device is impractical. This is different from traditional seed phrases, where physical possession of a written seed phrase is equivalent to complete compromise.

Second, backup procedures are simplified because Tangem uses seedless backup—additional backup cards instead of a vulnerable written seed phrase. A backup card is itself a complete secure element with its own tamper protection, so backing up keys means creating another protected device rather than writing down a plaintext secret. Multiple backup cards can be distributed to different locations, and they are protected with the same physical countermeasures as the primary card.

Third, the need to protect the mobile application is reduced but not eliminated. An attacker compromising the phone cannot steal keys directly, since the keys are never exposed to the phone’s operating system. However, the phone could be compromised in ways that allow the attacker to see which transactions the user is signing or to manipulate which transactions are presented for signing. The secure element protects the key, but the user should still maintain basic operational security with their mobile device, such as using updated software and avoiding untrusted applications.