NFC Relay Attacks on Tangem: Can Hackers Intercept Transactions from a Distance?

Tangem’s hardware wallet operates without batteries, screens, or cables—a design that shifts the security model away from traditional wallet form factors toward a card or ring that communicates with a smartphone via NFC. That elimination of intermediate hardware components reduces certain attack vectors, but it introduces a different question: if communication between the card and a mobile device happens over NFC radio waves, can an attacker position themselves between those two devices and intercept or manipulate transactions without physical possession of the card itself?

The concern is neither theoretical nor obscure. Relay attacks have been documented against contactless payment systems, building access cards, and other NFC-based authentication schemes. The attacker does not need to break cryptography; they only need to extend the effective range of the card’s radio signal or position themselves in the middle of a legitimate transaction. For users considering using Tangem Wallet for daily management of high-value cryptocurrency, understanding whether and how such attacks could succeed is essential to evaluating actual risk.

How NFC relay attacks work in principle

NFC communication is inherently short-range by design. The ISO 14443 standard used by most NFC devices specifies a nominal working distance of approximately 10 centimeters. That short range is both a strength and a constraint. A strength because it makes casual eavesdropping difficult; an attacker cannot simply point a receiver from across the room and listen. A constraint because any protocol relying on NFC must assume close physical proximity during authentication or transaction approval.

A relay attack bypasses that assumption by inserting two active radio relays into the channel. One relay (called the “proxy”) sits near the legitimate card and extends its signal to a second relay (the “reader”) positioned near the phone. The proxy receives any radio signal from the card and forwards it to the reader; the reader receives signals from the phone and forwards them back to the proxy, which retransmits to the card. From the card’s perspective, it is communicating with a genuine reader only centimeters away. From the phone’s perspective, it is communicating with a genuine card only centimeters away. The phone and card are actually separated by significant distance—potentially dozens of meters—yet the relay makes the interaction appear normal to both.

The attack does not require decryption or key recovery. It is a man-in-the-middle insertion that operates at the physical and link layers, below most cryptographic operations. The relay preserves the timing, amplitude, and bit sequences of the NFC communication without interpretation. If the attacker can establish this transparent relay, they can forward any legitimate transaction from the phone to the card and bring the card’s signed response back to the phone, completing a transaction that appears to the user to have occurred normally but actually happened at the attacker’s location.

NFC range extension and practical relay constraints

Building a relay attack requires more sophistication than broadcasting random signals. NFC operates at 13.56 MHz and requires careful antenna tuning, impedance matching, and phase alignment to avoid signal degradation. Commercial relay equipment exists—originally designed for testing and development—but the attacker must solve several practical problems. First, the proxy antenna near the card must be positioned close enough to detect weak NFC signals without physical contact. Second, the proxy and reader relays must be synchronized to avoid timing misalignment that would cause the card to recognize communication latency and abort. Third, the signal strength and noise floor must be managed so that relay amplification does not corrupt the data.

Researchers at universities including the University of Surrey and Delft University of Technology have built functional NFC relay systems in laboratory conditions. These demonstrations show that relay is technically feasible, but practical constraints matter enormously. The equipment is not pocket-sized. Active relays draw power and generate heat. The card’s firmware and the phone’s NFC stack may include latency detection. If the relay introduces measurable delay—even microseconds—the card may reject the transaction or the phone may timeout the operation.

The distance at which a relay becomes effective is typically measured in tens of meters under favorable conditions, not hundreds. An attacker would need to position relay equipment strategically (for example, in a location the target frequents) and coordinate the interception with the moment the target initiates a transaction. Passive listening from a distance is not feasible; active relay equipment is required, and that equipment is conspicuous and potentially detectable.

Tangem’s architectural defenses against relay

Tangem’s design includes several properties that complicate relay attacks even if the attacker can establish a relay channel. First, the card requires physical tap confirmation for every transaction. That confirmation is not a PIN entry on a remote screen; the user must physically hold the card near their phone and tap it. If the card is in the user’s wallet and the phone is in their hand or pocket, the attacker’s relay equipment must somehow position itself between those two devices without the user noticing. This is considerably more difficult than intercepting a contactless payment at a store checkout, where the card and reader are already separated by centimeters.

Second, Tangem performs hardware-based cryptography within the secure element chip. The card’s private keys never leave the hardware. When the user approves a transaction, the card signs the transaction data using its embedded cryptographic processor. The signature creation happens inside the secure element, protected against side-channel attacks and physical probing. An attacker who successfully relays the transaction request still cannot extract the private key; they can only ask the card to sign a transaction and collect the signed result.

Third, the phone displays the transaction details before confirmation. The user sees the destination address, amount, and network on their mobile screen. For a relay attack to succeed in stealing funds, the attacker must forward a transaction that appears legitimate to the user (so the user taps to confirm) but actually moves funds to the attacker’s address. This requires either deceiving the user through a fake phone interface—a separate attack—or assuming the user will confirm a transaction without reading the destination.

Fourth, Tangem uses NFC-based transaction confirmation rather than blind approval. The phone communicates the full transaction details to the card before the card signs. If relay latency or manipulation alters the transaction, the card may detect inconsistencies. The secure element runs firmware that validates the transaction structure, checks the transaction hash, and verifies that the user is signing what they intended.

When relay attacks become practical threats

Despite these defenses, relay attacks are not impossible; they are merely difficult and situational. The threat model changes based on three factors: the attacker’s goal, the value of the transaction, and the user’s behavior.

If the attacker is trying to steal a single high-value transaction, relay attack preparation becomes more cost-effective. Positioning relay equipment in a location the target frequents—an office, home, or regular meeting place—could enable the attacker to intercept a transaction at a moment they control. The attack would require the attacker to know that a large transaction is imminent, which might come from social engineering, malware on the target’s phone, or surveillance. The user would tap to confirm a legitimate-looking transaction, and the card would sign it, but the relayed request would have been modified to redirect funds.

If the attacker is trying to mass-steal small amounts from many users, relay attacks are impractical. The equipment is expensive, setup time is substantial, and detection risk is high. An attacker with the resources to deploy relay relays in many locations would likely find simpler attacks more efficient—such as malware that modifies transaction details on the phone’s screen before the user sees them.

High-value users in geographically predictable locations face the highest relay risk. A user who conducts frequent large transactions and follows a known routine could be profiled. A user who moves unpredictably, conducts transactions from varied locations, and maintains device security has much lower practical relay exposure.

Detection and mitigation from the user side

Tangem’s transaction confirmation process is already the primary user-side mitigation. Before tapping the card, the user should inspect the phone’s display carefully: destination address, amount in the smallest unit (satoshis, wei, or base tokens), and network confirmation. If an attacker relays the transaction, any modification at the bit level should cause the card to reject the request. However, if the attacker’s relay equipment is clean and latency is low enough, the card may sign without rejection.

Users can employ secondary checks. For high-value transactions, verbally confirm the destination address with the recipient before approving payment. For recurring transactions to the same address, use a small test amount first. For any transaction that seems unusual or unexpected, pause and verify the request through a separate communication channel with the sender.

Device hygiene matters significantly. Malware on the phone that modifies transaction details displayed on screen is a simpler attack than relay and is orthogonal to relay defense. Keeping the operating system updated, avoiding side-loaded applications, and reviewing app permissions regularly reduces the attack surface. The phone’s NFC stack should be kept current, as vendors occasionally patch NFC firmware to improve security.

Storage and handling of the card itself reduce relay opportunity. Storing the card in a Faraday pouch or shielded case when not in use prevents attackers from detecting the card’s signal and positioning relays around it. This is impractical for frequent users but valuable for high-net-worth individuals who make large transactions infrequently. For daily-to-day use, keeping the card in a regular wallet or pocket provides sufficient obscurity that relay equipment positioned without specific knowledge of the card’s location is unlikely to intercept transactions.

Comparison with other hardware wallet attack surfaces

Tangem’s relay risk should be contextualized against other hardware wallet vulnerabilities. Traditional hardware wallets with screens and buttons (such as Ledger or Trezor) require an attacker to either compromise the device physically or exploit firmware to display false transaction information. They communicate through USB or Bluetooth, which have their own relay attack variants, though those are less documented in practice.

Tangem’s NFC design eliminates the screen and physical buttons that could be compromised. It also eliminates the battery and charging port that could be targeted for hardware implants. However, it shifts the trust boundary: instead of a device-local screen, trust now rests on the phone’s display and the card’s cryptographic validation. If the phone’s operating system is compromised, the user could be shown false transaction details while the card signs the true transaction. This is not a relay attack; it is a phone compromise. But it is a reminder that the phone is now part of the cryptographic trust path in ways it is not for traditional hardware wallets.

NFC relay attacks are real but contextual. They are most practical against high-value transactions from geographically predictable users. They are impractical for mass theft. They require expensive, detectable equipment. And Tangem’s architecture—requiring physical confirmation, performing signing in a secure element, validating transactions on-device, and using distance-sensitive NFC communication—raises the bar considerably compared to simpler contactless payment systems.

Future mitigations and open questions

Several technical directions could reduce relay risk further. Distance-bounding protocols measure round-trip communication latency at the bit level and reject messages that arrive too slowly, suggesting relay. Such protocols are theoretically sound but difficult to implement reliably across different device hardware. If Tangem incorporated distance bounding into its card firmware, relay attacks would require sub-microsecond synchronization between relay equipment—raising cost and complexity further.

Randomization of transaction protocols could also help. If the card randomizes the sequence of requests or includes challenge-response nonces that the phone must verify, a passive relay becomes more difficult. An attacker would need not just to pass signals through but to understand and sometimes modify them, which risks detection.

The longer-term question is whether NFC cryptocurrency wallet adoption creates ecosystem incentives for relay attack improvement. If millions of users adopt NFC wallets, attackers may invest in developing more efficient relay equipment, miniaturization, or automated detection of NFC fields. That risk is not unique to Tangem; it applies to any NFC-based NFC crypto wallet architecture. The security community’s ability to identify and patch new relay techniques depends on continued research, responsible disclosure, and coordination between wallet vendors and security researchers.

Users should also recognize that relay attacks are not the only risk. Social engineering, malware, SIM swaps, seed phrase compromise, and phishing remain far more common attack vectors. A relay attack requires substantial preparation and coordination. A user’s unguarded recovery phrase, shared with a support scammer, is exploited in minutes. The relative threat ranking matters: Tangem’s design is notably strong against relay compared to simpler contactless systems, but it is only one part of a broader security posture.