A user manages cryptocurrency across multiple blockchains and wants to hold tokens on their phone without trusting an exchange or centralized service. They need to interact with decentralized applications, approve transactions quickly, and access their assets regularly—but they also need the private key to remain offline and inaccessible to software running on the device. That tension has traditionally forced a choice: either accept custody exposure by keeping keys in a mobile app, or accept friction by requiring an external hardware wallet for every transaction. Tangem eliminates that trade-off by separating asset management from key management entirely.
The core insight is architectural: a mobile application can handle all interaction with blockchains, display balances, construct transactions, and manage user preferences while a physically separate device performs the only operation that matters cryptographically—signing. The wallet does not require a battery, cable, or screen because the phone provides those. It does not leak private keys into app memory because the chip performs all cryptographic operations in isolation. The result is a non-custodial hardware wallet that feels like a conventional mobile app while maintaining the security guarantees of an offline signing device.
The problem with app-based key storage and why isolation solves it
Mobile operating systems have encrypted storage, secure enclave components, and permission models designed to protect sensitive data. In practice, those protections work only as well as the application that uses them. An app can leak keys through logging, crashes, debugging interfaces, or unintended copies in memory. The operating system itself may be compromised, a device may be lost, or malware may request permissions that users approve without understanding the implications. A compromised phone means compromised keys if those keys ever exist in application memory, no matter how well encrypted they were at rest.
The conventional response is to use an external hardware wallet: keep the private key on a separate device and never allow it into the phone. That works, but it introduces friction. Every transaction requires moving to a different device, waiting for confirmation, and managing a separate interface. For frequent users trading tokens, managing positions, or interacting with DeFi protocols, that overhead becomes prohibitive. The intuitive choice becomes to keep keys in the phone for convenience, accepting the security compromise as the price of usability.
Tangem’s design removes that forced choice by keeping the key offline while the app remains practical. The phone never sees or touches the private key; it handles only the data representation of assets, addresses, and transaction construction. The physical card or ring contains the actual cryptographic material. When a transaction must be signed, the phone sends the unsigned transaction to the card via NFC, the card performs the signing operation inside a tamper-resistant secure element, and the signed result is returned to the phone for broadcast to the blockchain. At no point does the private key leave the hardware.
This separation has implications that reach beyond the obvious security benefit. Because the phone cannot sign arbitrary transactions—it can only request that the card sign them—malware cannot simply impersonate the application to drain the account. The attack surface is fundamentally different. The threat is no longer «compromise the phone and extract keys,» but rather «compromise the phone to trick the user into confirming a malicious transaction on the card.» That is a harder problem that requires social engineering or UI confusion rather than just technical exploits.
How the mobile app manages assets without managing keys
The Tangem application available for Android and iOS operates as a conventional blockchain wallet interface: it displays balances, shows transaction history, allows users to enter receiving addresses, and presents confirmation screens. But it never holds the ability to spend. Every asset ultimately resides on a blockchain, and access to spend requires the private key. The app calculates what would happen if a transaction were approved, shows the user the details, and prepares the request—but the actual spending authority remains locked in the card.
This design becomes powerful when managing thousands of cryptocurrencies across multiple blockchains. Bitcoin, Ethereum, Litecoin, Solana, ERC-20 tokens, and other assets all appear within one application interface. The phone constructs and displays the transaction data for each asset type, understanding the specific rules of each blockchain and formatting the transaction correctly. The card, meanwhile, holds a master key from which all individual asset keys are derived. The same secure chip can sign transactions for Bitcoin, Ethereum, and any other asset without the phone needing to move physical keys between devices.
The app also handles the practical work of blockchain interaction. It queries balances from blockchain nodes or indexing services, estimates gas fees, monitors transaction confirmation, and maintains address books or labels for easier spending. None of this work requires private keys. The app can be updated, reinstalled, or replaced entirely, and the underlying assets remain secure as long as the card is not lost. This is why a user can recover from a lost or broken phone far more easily than from a lost seed phrase: the card contains all necessary cryptographic material, independent of any application state.
Non-custodial security means the issuer cannot freeze or steal funds
Tangem does not hold keys in a data center or control signing servers. It manufactures the hardware device and provides the application software, but once the wallet is created, the issuer has no ability to move the user’s funds, freeze access, or decide which transactions are permitted. That is what non-custodial means in a practical sense: the keys and signing authority remain with the user, not delegated to a service provider.
This distinction matters because it removes an entire category of risk. With a centralized exchange or custodial service, the user’s security depends partly on the operator’s security practices, financial health, regulatory compliance, and resistance to legal pressure or theft. A Tangem hardware wallet instead depends on the user’s physical security and password discipline, since the user alone controls the card and the PIN that protects it.
The trade-off is real: the user becomes responsible for not losing the card, not exposing the PIN, and not using a compromised phone to manage transactions. There is no customer support team that can recover a lost card or override a lost PIN. If the card is destroyed, backup cards created during initial setup can restore access to the same assets. But if all cards are lost and no backup exists, the funds are inaccessible. This is the correct outcome from a security perspective—it means nobody, including Tangem itself, can access the account without authorization. It is also why backup cards should be stored carefully.
Transaction confirmation through NFC keeps the signing step isolated
When a user initiates a transaction in the mobile app, the phone displays a detailed summary including the recipient address, amount, estimated fee, and total cost. The user reviews this information on the phone’s screen and decides whether to proceed. If they confirm, the phone sends an unsigned transaction to the card via NFC—the same contactless technology used for payment cards. The card receives the transaction data, verifies that it is cryptographically well-formed, signs the transaction inside the secure element, and returns the signed result.
This NFC-based flow introduces a crucial security property: the signing step is explicit and requires physical contact. The user must hold the card near the phone, confirming through an intentional gesture that they want to sign. This prevents the most dangerous attack scenario in mobile security: background signing. Malware cannot trigger a transaction without the user’s knowledge because there is no automatic signing. The user sees what they are signing, chooses to bring the card near the phone, and the card handles the actual operation.
The NFC communication itself is not encrypted—the transaction details are sent in the clear and the response is readable—but that is not a problem because both are non-secret. The transaction data is about to be broadcast to thousands of nodes on a public blockchain anyway. What matters is that the private key remains on the card and does not appear in transit. Someone intercepting the NFC signal learns what the user is about to sign, which is already public information. They cannot forge a signature without the key.
This design also prevents a subtle attack vector: a compromised app cannot silently submit multiple transactions. Every transaction requires user action. A malicious app could try to construct a misleading transaction or display false information to trick the user, but that is an interface attack, not a cryptographic one. The user can mitigate it by understanding where the app came from (Tangem’s official distribution channel), keeping the phone updated, and reviewing transaction confirmation details carefully before holding the card near the phone.
Seedless backup using multiple cards instead of a recovery phrase
Traditional cryptocurrency wallets use a seed phrase—typically twelve or twenty-four words—that can regenerate all private keys. The seed must be written down, stored offline, and protected carefully. It is powerful but fragile: anyone who learns the seed controls the entire wallet forever. Tangem replaces this model with multiple backup cards created during wallet setup.
When a wallet is first initialized, the user receives the main card and can create one or more backup cards. Each backup card can restore access to the same assets and derive the same keys as the main card, but they are physically separate pieces of hardware. If the main card is lost, stolen, or damaged, any backup card can serve the same function. If the main card is compromised and a user suspects the PIN has been discovered, they can switch to a backup card and invalidate the original. The backup cards contain the same cryptographic material but are distinct physical objects stored in different locations.
This approach has security advantages over seed phrases. A seed phrase is a password—once it is written down or typed anywhere, it is potentially exposed to multiple attack vectors: theft, photography, screen capture, handwriting recognition, or simple human memory failure. Backup cards are physical objects that do not require being typed or memorized. They are not passwords; they are separate hardware devices. Someone would need to steal the actual card, not just know a sequence of words. Additionally, each backup card has its own PIN, and the original card can be invalidated separately from backups. This allows for more flexible recovery scenarios.
The limitation is that backup cards must be created at setup time and stored securely. They cannot be created later if the user loses the main card, unlike some wallet recovery methods that work with just a seed phrase. This is why the backup process is important: users should create backup cards immediately and store them separately before using the wallet for significant amounts.
Hardware durability and the practical advantage of no battery or cables
A Tangem card or ring is water-resistant, dust-resistant, and requires no battery, charging cable, or screen. These constraints were not chosen arbitrarily; they reduce the number of components that can fail or require maintenance. A traditional hardware wallet might have a small screen, buttons, and a micro-USB or USB-C port. Each of these is a potential failure point: screens crack, buttons wear out, or ports break when bent. A Tangem card is essentially a thick payment card with an embedded chip; the form factor is durable by design.
The lack of a battery eliminates a major constraint. Users do not need to remember to charge the device before traveling, do not need to carry a cable, and do not have to worry about battery degradation over years of storage. The card can sit in a drawer for a decade and work perfectly when retrieved. The ring format offers similar advantages while fitting a wearable use case for users who prefer to keep their wallet accessible.
The lack of a screen means the card cannot display transaction details on its own. This is where the phone becomes essential: the phone shows what will be signed, the user reviews it, and the card signs if the user approves. Some users initially perceive this as a limitation—there is no independent display to verify the transaction. In practice, it is a reasonable trade-off. The phone’s screen is superior for displaying complex information, and the NFC confirmation gesture provides the security property that matters most (explicit user action for each signing operation).
Durability also extends to cryptographic operations. The secure element inside the card performs all signing without creating side-channel information that could leak the key. It does not log operations, does not store temporary values in memory after use, and does not expose timing variations that could be analyzed. The hardware is designed and certified specifically for this purpose, unlike a general-purpose phone processor that handles millions of different tasks.
Integration with decentralized applications through standard wallet protocols
A Web3 wallet does not operate in isolation; it must connect to blockchain applications for users to actually use their assets. Tangem supports standard connection protocols such as WalletConnect, EIP-6963 (for direct app-to-wallet communication), and mobile deep linking. When a user encounters a decentralized application that requires wallet connection, they can select Tangem from the available options.
The integration works the same way as in-app transactions: the application requests a transaction or message to be signed, the request is sent to the card via NFC, the card signs it, and the result is returned. The application never communicates directly with the card; it only interfaces with the Tangem app. This provides a clean separation: decentralized applications can operate on multiple blockchains and manage complex interactions without needing to know anything about the cryptographic hardware underneath.
This architecture also means that a user can change applications or try different DeFi protocols while using the same Tangem wallet. The assets and keys do not belong to any single application; they belong to the user as represented by the hardware card. If an application is compromised or deprecated, the user simply stops using it and switches to another. The Tangem application provides the wallet interface, application developers provide the interface to blockchain services, and the hardware provides the actual security.
The main limitation is that applications must explicitly support Tangem or standard wallet protocols. It cannot be injected into every website the way browser extensions can, which is a deliberate design choice: reducing the number of ways that malware can intercept or manipulate wallet interactions is more important than universal compatibility. A user who wants to use a specific application should verify that it supports Tangem or Web3 wallet standards before committing significant assets.
When app-based management with hardware signing is the right choice
Tangem is strongest for users who prioritize mobile convenience without accepting custody risk. Someone holding crypto that they intend to use regularly—trading, DeFi interaction, or frequent transfers—benefits from having a responsive app experience while keeping keys offline. The hardware is also appropriate for users managing multiple asset types across different blockchains, since a single card can handle all of them and the phone provides a unified interface.
The model works well for moderate to large holdings where the security guarantee of non-custody is important, but where the user is willing to accept some operational responsibility for backup cards and PIN protection. It is less ideal for users who want absolute minimal operational burden and are comfortable with custodial or semi-custodial solutions, or for users who need to make transactions without access to NFC-capable phones.
For users considering hardware security but uncertain about complexity, Tangem offers a middle ground between full mobile app security and full hardware wallet friction. The Tangem Wallet download is the entry point for Android and iOS users, but it is important to understand that the app is the interface, not the security. The card is the security. A compromised phone can make the app unreliable, but it cannot compromise the funds because the keys remain hardware-isolated.
The decision ultimately comes down to matching threat model to usage pattern. A user storing significant assets that they access frequently from a mobile device has few better options than hardware-backed mobile signing. A user storing crypto for long-term holding with minimal access might prefer a completely air-gapped hardware wallet or a cold storage method. A user accepting custody has the convenience of exchanges but trades security for speed. Tangem optimizes for users in the first category: security-conscious but practically mobile-dependent.
Frequently asked questions
Can Tangem be compromised if my phone is hacked?
A compromised phone cannot access the private keys because they are stored only on the card. Malware could potentially trick the app into displaying false information or attempt to trick you into signing a malicious transaction, but the actual signing operation happens inside the secure element on the card, offline from the phone’s processors. This is why reviewing transaction details before NFC confirmation is important. The card itself resists physical tampering through tamper-resistant design and certification standards.
What happens if I lose the Tangem card?
If you created backup cards during setup, you can use any backup card to restore access to the same wallet and assets. If you did not create backup cards, access is lost permanently. This is why creating and storing backup cards in a separate location is essential before using the wallet with significant amounts. Each backup card has its own PIN and can be used independently.
Does Tangem support all cryptocurrencies?
Tangem supports thousands of cryptocurrencies including Bitcoin, Ethereum, Litecoin, Solana, and most ERC-20 tokens across multiple blockchains. Support is determined by the mobile app and the blockchains it connects to rather than limitations in the hardware. Older or extremely obscure assets may not be supported in the app, but the range covers the vast majority of assets people actually hold.