cuneytyeshil

Dear #Tangem users, this is about our money, not marketing. So read and share! i like tangem but there is a problem.... Tangem responds very quickly to positive posts about itself. Yet when these questions are asked, they keep ignoring them.🤬 Tangem and I follow each other. So the chance that they simply did not see these questions is basically zero. At this point, it does not look accidental. It looks deliberate. They are choosing not to answer. And that only increases my suspicions. I have asked @Tangem these security questions multiple times.I still have not received answers !!! So I am going to keep asking publicly. I will also ask Tangem communities worldwide to support these questions. Because these are not minor technical details. Our private keys and our money depend on the answers. My questions are very simple: Which exact firmware runs on our Tangem card? Was that exact firmware build independently audited? Does the production binary match the source code that auditors actually reviewed? Saying “we’ve been audited” is no longer enough. Kudelski’s 2018 audit covered firmware version 1.28!! Tangem firmware has evolved significantly since that audit. Tangem’s SDK references later firmware generations and features, including versions 4.39, 6.21, 6.33 and 8.58. So the obvious question is this: Which firmware runs on each Tangem 1.0 and Tangem 2.0 cards? And which independent audit covers that exact firmware version? Riscure’s 2023 review examined firmware code, architecture, NFC commands, key isolation and side-channel protections. It reported no private-key exposure or exploitable firmware backdoor. That is a strong security result. But the public report does not identify the exact audited firmware version or production binary hash. Was the audited firmware 6.21, 6.33r, or another production build? Users currently cannot independently verify that connection. Tangem’s immutable firmware should make this one of its strongest security arguments. Instead, users still cannot easily connect their card to a specific audit. Tangem could solve this with one simple public table: Card Model → Firmware Version → Firmware Hash → Audit Firm → Audit Date Closed-source firmware should not require users to accept: “Trust us, it was audited.” The standard should be: “This exact firmware runs on your card. Here is its hash. Here is its independent audit.” The Coldcard incident showed why firmware provenance and key-generation transparency matter. A Secure Element and an independent audit are important, but they are not complete answers. Users should know which firmware generated and protects their private keys. They should also know whether auditors reviewed that exact production build. Tangem already has a strong security story. Kudelski, Riscure, Cure53, EAL6+ certification and immutable firmware are meaningful security arguments. What is missing is the verifiable link between each card, its firmware and its audit. Publishing that mapping would remove unnecessary uncertainty. It would also set a much stronger standard for closed-source hardware wallets. So @Tangem, please answer these three questions directly: 1. Which exact firmware runs on each Tangem card generation? 2. Which independent audit covered each exact production firmware version? 3. Can users verify the production firmware hash against the audited build? These are reasonable questions. Tangem users deserve clear and verifiable answers.