A paper clip became the Switch’s most famous security object

In the spring of 2018, an image began circulating through the gaming and security communities: a Nintendo Switch, a tiny conductive object, and an implication that seemed almost comic. One of the world’s most carefully engineered game consoles could be placed into a special mode with something resembling office stationery.

The image was memorable because it reduced an invisible technical failure to a household gesture. A reader did not need to understand boot-ROM memory handling, USB request parsing, or cryptographic trust chains to grasp the absurdity of a paper clip apparently standing between Nintendo’s platform security and the outside world.

But the image was also misleading when shortened into the familiar phrase “a paper clip hacked the Switch.” It did not. The paper clip was an improvised physical-access tool: a way to trigger Recovery Mode, usually called RCM, on eligible early hardware. It did not contain an exploit, run code, defeat a signature check, or unlock Nintendo’s software by itself.

The actual security failure lived inside an Nvidia Tegra X1 boot ROM. The physical trigger, the vulnerable processor, and the USB exploit were separate parts of one chain. Understanding that chain is the key to understanding the history that followed: the independent research of Kate Temkin and ReSwitched and fail0verflow, the rise of Switch homebrew and Linux, and the later commercial products that turned a research opening into a business opportunity.

Nintendo’s chain of trust began before the operating system

The Switch was designed around a chain of trust: a sequence in which each stage of the boot process authenticates the next before handing over control. In simplified form, an immutable first-stage program starts the machine, checks a later boot component, and permits it to execute only if the cryptographic verification succeeds. That component then validates the next stage, continuing upward until the console’s ordinary system software is running.

This is principally a story about signature verification, not encryption. Encryption conceals information from anyone without the required key. A digital signature answers a different question: did an authorized party approve this software, and has it changed since it was approved? Nintendo could encrypt game data and system components, but the boot chain’s central decision was whether a given piece of code was signed by a trusted authority.

Imagine a succession of sealed envelopes. The first envelope is built into the machine and contains the instructions for checking the second. The second checks the third, and so on. If an outsider cannot open or replace any envelope, the chain remains intact. But if the instructions inside the first envelope contain a mistake in how they receive or process information, an attacker may be able to interfere before the later envelopes are ever examined.

That early position made the boot ROM unusually important. Ordinary firmware can often be replaced through a system update. An immutable ROM is different: its instructions are fixed in silicon at manufacture. Nintendo could change Horizon, patch services, revise later boot software, and distribute updates, but it could not rewrite the vulnerable first-stage code inside already manufactured processors. The lasting remedy had to be a hardware revision, not merely a downloadable patch.

The distinction also explains why broad statements about “every Switch being permanently exploitable” are wrong. Early units using the affected Tegra implementation were vulnerable to the original path. Later Erista revisions and subsequent hardware, including Mariko-based systems, changed the relevant boot behavior. The flaw was historically powerful precisely because it was fixed in silicon on one generation—not because every Nintendo Switch shared the same permanent weakness.

Recovery Mode was useful by design—and dangerous by position

A modern device needs a way to recover when an update fails, system storage becomes corrupted, or service personnel must diagnose a machine that cannot complete an ordinary boot. That requirement creates a difficult security compromise. Recovery software must operate before the normal operating system, yet anything operating that early is close to the root of the device’s authority.

Nvidia’s Tegra boot flow included a recovery pathway capable of communicating over USB and accepting material used for recovery operations. On a healthy console, the user normally sees none of this machinery. The Switch boots through its expected sequence, Nintendo’s software establishes its rules, and the recovery service remains a low-level engineering and service function.

The Switch’s RCM was not the ordinary game-loading environment. It was a pre-operating-system state intended for recovery and service. Its existence was not itself a design mistake. The problem was that the affected Tegra boot ROM did not safely handle a specially malformed USB request sent while that recovery implementation was active.

That distinction matters because a recovery interface is not automatically an open door. RCM by itself did not grant arbitrary execution. It was a service entrance: a place where communication became possible before the rest of the security system had finished asserting control. The vulnerability was in how that entrance processed hostile input.

Security engineers often describe such interfaces as attack surfaces because they sit at a boundary. Recovery has to accept information from outside the main operating system, but it also has to be trusted with exceptional authority. The Switch became a particularly clear example of an old engineering tension: the more useful a pre-boot service mode is for repair and recovery, the more carefully its input handling must be designed.

What the famous paper clip actually did

The right Joy-Con rail contained contacts associated with the console’s recovery condition. Researchers and enthusiasts found that a conductive object could bridge the relevant area sufficiently to request RCM when combined with the appropriate physical sequence. The improvised tool became known as the paper clip, although safer purpose-built recovery triggers soon became more common in the surrounding community.

That sequence also explains why the paper clip became so culturally powerful. It was not the deepest technical detail, but it was the part people could see. The boot ROM was microscopic and abstract. A buffer overflow was invisible. A bent piece of metal made the whole story tangible.

The memory bug in plain English

The vulnerability, later catalogued as CVE-2018-6242, involved a USB control-transfer path whose length information could influence a copy operation. The destination buffer had a fixed capacity, but the code did not adequately ensure that the requested amount would fit. Data beyond the intended boundary could overwrite nearby stack information, including state that influenced where execution returned.

An analogy is a warehouse whose clerk obeys a delivery form stating how many boxes to move, without checking whether the storeroom can hold them. Once the room is full, excess boxes spill into adjacent offices and alter the paperwork there. In a processor’s memory, those neighboring offices can contain saved control data. The historical significance was not the particular arrangement of bytes but the fact that USB input could damage the boot ROM’s own working state before normal authorization checks became decisive.

This is why descriptions such as “the Switch’s encryption was cracked” obscure the important lesson. The attacker did not defeat a cipher. The attacker reached a privileged component with a memory-management mistake and used that mistake to redirect execution. The security boundary failed because code ran where it should not have, not because Nintendo’s cryptographic algorithms stopped working.

Fusée Gelée and ShofEL2: two independent research efforts

Kate Temkin and ReSwitched documented Fusée Gelée, while fail0verflow independently developed ShofEL2. Both reached the underlying Tegra recovery weakness, subsequently identified as CVE-2018-6242. These were research efforts with their own implementations and priorities, rather than one commercial product passed between teams.

Temkin’s Fusée Gelée disclosure appeared on April 23, 2018. Fail0verflow published its ShofEL2 explanation on April 24 and said it had found the bug first, while another group had independently discovered and published it. Earlier public demonstrations had already signaled fail0verflow’s work. The distinction between private discovery and public disclosure explains why a single winner’s name does not capture the history.

Team Xecuter did not discover this public boot-ROM vulnerability. Its later products packaged access for customers. Finding a flaw, documenting an exploit, maintaining an open software environment and selling a convenient accessory were separate achievements, carried out by different people with different goals.

A permanent flaw did not mean a permanently installed jailbreak

Fusée Gelée was powerful partly because it did not depend on a vulnerable application already running inside Horizon, the Switch operating system. It targeted the earliest phase of startup, before Nintendo’s ordinary software permissions and integrity checks had fully taken control.

The flaw survived a reboot because the same immutable startup code ran again. The modified environment did not necessarily survive with it. The original publicly demonstrated route was tethered: after a full power-off, launching custom code again required another recovery-and-payload session. Leaving a console asleep and performing a fresh cold boot were different situations. The exploit could be repeated; it had not rewritten the processor’s ROM.

A userland vulnerability can disappear when a console reboots. A software jailbreak can be closed by replacing the affected application or updating the operating system. A boot-ROM flaw is more persistent because the same flawed silicon is consulted again each time the machine starts. If the console is vulnerable, restarting it does not replace the ROM.

That durability was also limited. The attack required physical access and a compatible hardware implementation. Nvidia’s security information did not describe a remote attack against ordinary internet-connected consoles. The exploit’s importance came from its position in the boot sequence, not from magical reach across a network.

The lesson extended beyond Nintendo. Any recovery service that accepts external input before the main security policy is active deserves the same scrutiny as a more visible network-facing feature. A device may be locked down at the operating-system level and still expose a narrow, high-authority pathway during recovery. The Switch’s early boot-ROM error showed how much power can reside in a component most owners never know exists.

The opened door led to homebrew, Linux, and experimentation

Once the boot barrier was bypassed on eligible hardware, the Switch scene divided into overlapping but distinct projects. Some developers wanted homebrew: independently written applications, emulators, research tools, accessibility experiments, utilities, and alternative system components. Others wanted to study the console’s hardware, investigate its security model, or bring Linux to a device designed around Nintendo’s software stack.

Atmosphère became one of the most prominent open-source projects in this wider movement. Its development represented a substantial community effort to understand and modify the Switch environment while publishing code and research. The project should not be collapsed into piracy simply because the same low-level access could also be used to run unauthorized copies of commercial games.

This dual-use quality is central to the history. An unsigned-code environment may support a debugger, a preservation tool, an accessibility modification, a Linux port, an emulator, or a pirated game. The exploit itself does not know which purpose comes next. Its legal and ethical character depends on the surrounding tool, its distribution, its marketing, and the user’s conduct.

There were also genuine disagreements inside the technical community over licensing, attribution, closed releases, and commercial packaging. Open-source developers cared about whether code and credit were being respected. Researchers cared about disclosure and reproducibility. Users often cared about convenience. Commercial operators could package complicated work into products that required less technical knowledge and presented a clearer consumer experience.

Those interests were not identical. The homebrew community’s interest in studying or extending a purchased device did not automatically make every circumvention product legitimate. Conversely, the existence of piracy-oriented products did not make all homebrew, Linux, preservation, or independent development equivalent to copyright infringement. The Switch’s security story became difficult precisely because the same broken barrier served very different communities.

Atmosphère turned a vulnerability into an open architecture

Atmosphère pursued a different goal from ShofEL2’s Linux demonstration. It became an open, community-developed customized firmware for Nintendo’s Horizon environment. The project did not simply replace the Switch with another operating system. It modified and reimplemented layers of the environment while retaining the console’s basic software identity, much as a city might be extensively renovated without abandoning its street plan.

SciresM became a leading developer and a familiar public voice for Atmosphère, alongside a wider group of contributors. Its first official release, 0.7.0, arrived in October 2018. The exploit supplied an entry point on affected hardware; the project supplied an environment people could continue developing. Those are very different amounts of work. A demonstration can prove that a boundary has failed in minutes, while a usable system must handle ordinary behavior reliably day after day.

Atmosphère’s component names describe different jobs. Its fusee bootloader starts the customized environment; the name is related to the project’s naming scheme but is not another name for the Fusée Gelée vulnerability. Exosphère supplies a customized secure monitor at the highly privileged boundary between the operating system and security-sensitive services. Stratosphère encompasses system modules and supporting infrastructure. Mesosphere, added later, is a replacement kernel. emummc redirects the console’s internal-storage view to a separate backing store.

Early Atmosphère releases supported homebrew services, crash reporting, filesystem interception and redirection of executable or RomFS content. Later components expanded the architecture. Treating the modern feature list as something that appeared fully formed in April 2018 would miss years of development. The initial breach and the mature custom firmware belong to the same history, but they are not the same event.

What custom firmware changes after the console has booted

A bootloader’s job ends relatively early. Once a customized environment is running, the harder practical questions begin: which services receive requests, where files come from, how processes are launched and what happens when an application crashes. That is where custom firmware becomes more than a dramatic startup trick. It changes the conditions under which software lives.

Consider a fan translation or an accessibility modification. Rather than rebuilding a console’s entire operating system, a developer may want a game to see replacement resources at selected paths. Filesystem redirection can change that view while retaining the rest of the game’s ordinary structure. A debugging tool has a different need: useful crash information or access to behavior that the retail interface never exposes. These are examples of why an open environment can be valuable even when its user has no interest in copied commercial games.

The kernel occupies a lower layer. It manages fundamental facilities such as processes, memory and communication. Reimplementing that layer, as Mesosphere does, is a sustained compatibility exercise: software above it expects familiar behavior, including details a normal player never sees. A replacement that merely launches once is not finished. Games and services must continue behaving consistently across a much wider range of conditions.

emummc addresses another problem: separating a customized storage environment from another system state. The console can be made to use redirected storage rather than treating the same internal storage as the only available world. This can help with experimentation and recovery planning. It is not a promise that Nintendo cannot detect activity, nor does it turn an online service into a private test network. Storage separation and network authorization are different boundaries.

The distinction between Atmosphère and Linux is equally useful. A Linux port takes the hardware toward a different operating-system environment. Atmosphère works with and customizes the Horizon environment associated with the Switch. One asks what else the hardware can run; the other asks how the existing system can be extended or reimplemented. Researchers and users can value both without treating them as interchangeable products.

The less glamorous work that kept Atmosphère alive

Nintendo continued changing its system software after 2018. A custom-firmware project therefore faced a moving target: new services, changed behavior, compatibility assumptions and revised internals. Possessing an entry point into an early console did not automatically make every later software version work. Developers still had to understand what changed and adapt the surrounding environment.

That maintenance is easy to overlook because it rarely produces an image as memorable as a paper clip. Yet it is what separates a historical exploit demonstration from a platform that people can keep using for development. Documentation, bug reports, testing and code review are part of the achievement. The opening in silicon was durable; the software built above it still needed care.

Open development also made architectural disagreements visible. Contributors could inspect code, discuss regressions and challenge design choices. Commercial packaging optimized a different relationship: a customer expected a purchase to simplify a complicated process. Neither relationship describes every person in the scene, but their different incentives help explain why Atmosphère and Team Xecuter should not be treated as two labels for the same organization.

Hardware limits made the breakthrough powerful—but not universal

The original recovery vulnerability was tied to particular Tegra silicon and the way that implementation handled USB input in RCM. That hardware boundary placed clear limits on the exploit’s reach. An early vulnerable Switch could remain susceptible after ordinary system updates because the immutable boot ROM remained unchanged. A later revision that corrected the boot implementation was not made vulnerable simply by receiving the same software.

Hardware changed within the Erista generation too. Later patched Erista units closed the original public recovery route before the wider move to Mariko-based hardware. The Switch Lite also used revised hardware. A processor-family nickname alone therefore cannot establish vulnerability: an early unpatched Erista and a later patched Erista are not equivalent targets.

Nintendo could continue updating software on affected machines, while correcting the recovery path in newly manufactured hardware. This created an unusual divide in the installed base: consoles that looked almost identical on a shelf could have very different low-level security properties. An ordinary firmware update could not replace the immutable instructions in an already-sold vulnerable chip.

The vulnerability also did not eliminate Nintendo’s entire security architecture. It allowed execution before the normal chain of trust could do its intended work on affected machines. That was a profound breach of the boot boundary, but it did not mean every key, every server, every online service, or every later console had become equally exposed.

Later Switch research examined other avenues, including high-level fault-injection approaches against revised hardware. Those investigations belong to a subsequent chapter and should not be merged with the 2018 Tegra recovery bug. The broad historical pattern is enough: once a manufacturer closes one boundary in silicon, researchers look for the next boundary in the chain.

The name before the Switch

Team Xecuter did not begin with Nintendo’s hybrid console. The name belonged to an older generation of console modification, when the commercial frontier ran through optical drives, region locks, copied discs, and the boundary between factory software and code supplied by the owner. Its earlier products were associated with Xbox and other platforms, where a physical modification could turn a tightly controlled machine into something more permissive—and, in many cases, something capable of running unauthorized copies.

The label was more durable than any single product. It operated as a brand, a community identity, a marketing voice, and a network of technical and distribution relationships. That makes the personnel history unusually difficult to reduce to a neat founding myth. An engineer who develops a modification, a supplier who manufactures it, a reseller who ships it, and a public representative who sells it may all be described casually as “Team Xecuter,” even when their responsibilities differ substantially.

Paul Owen, Neo Technologies and the PlayStation case

Long before SX OS, the British PlayStation modchip market had already reached the courtroom. Sony Computer Entertainment v Owen, [2002] EWHC 45 (Ch), was decided by Mr Justice Jacob on January 23, 2002. Paul Owen traded as Neo Technologies. The litigation concerned devices for defeating PlayStation protection mechanisms, including the PlayStation 2 Messiah modification. It was a civil dispute about copyright protection and commercial supply.

Optical-disc consoles presented a tempting contradiction to import enthusiasts. A customer could buy an authentic game overseas and still find that a machine rejected it. Regional checks divided markets, while authentication mechanisms helped distinguish authorized discs from copies. A modification could interfere with those checks, making a single product attractive to an import collector and to someone wanting to use copied discs. That overlap became central to the arguments around modchips.

Owen relied on asserted lawful uses, including imported games and backup-related arguments. Sony’s answer concerned the statutory protection for its technical system. Under the version of section 296 of the Copyright, Designs and Patents Act 1988 considered by the court, a device specifically designed or adapted to circumvent copy protection could attract liability. The question was not simply whether an owner could describe one sympathetic reason for modifying a console.

The January judgment granted Sony summary judgment on liability. The court did not accept that the asserted lawful uses defeated the claim. Its discussion also addressed additional damages in principle in connection with breaches of an injunction. That is different from saying the decision fixed a particular damages bill: liability, injunctive protection and the assessment of money are distinct parts of a civil case.

The import argument should not be flattened into a rule that buying a genuine foreign game is always unlawful. The court was considering particular protection mechanisms, software licensing and copying arguments under the law then applicable. Equally, a consumer’s ownership of a disc did not automatically settle the legality of supplying equipment designed to bypass the console’s protection system.

There was no criminal prison sentence in this judgment. That difference becomes especially important when Owen’s name is placed beside Gary Bowser’s two decades later. The Sony case concerned civil liability; Bowser eventually pleaded guilty to federal offenses. Their appearance in the same history of console modification does not make the proceedings interchangeable.

An old name under later ownership

In its 2023 Gary Bowser episode, Darknet Diaries reported that Max Louarn acquired the Team Xecuter brand, website and supply relationships from Paul Owen. That reported transfer provides a useful explanation for the continuity of the name across different eras. It should not be mistaken for a court finding about every individual who worked on every product.

The distinction is the one easily lost in retrospective headlines. The earlier Team Xecuter and the later Switch business shared a recognizable brand, but a surviving brand does not establish unchanged ownership, management or personnel. A name can travel with a website and a distribution network while the people making decisions behind it change.

For customers, continuity had commercial value. A familiar name carried the memory of previous hardware, forum support and products that had worked. For historians, it creates a trap: the reputation survives more visibly than the paperwork. The useful question is who owned, developed, marketed or distributed a particular product at a particular time, rather than treating decades of activity as the work of one unchanging group.

The Switch presented a new commercial opportunity

That distinction created an opening for commercial packaging. Research documentation can be demanding, fragmented, and aimed at developers. A commercial product can promise a smoother experience, supply hardware, manage licenses, and turn a technical possibility into a retail proposition. The business opportunity did not require the seller to have discovered the vulnerability. It required the seller to package access to an existing opportunity more conveniently than most users could manage themselves.

Team Xecuter’s Switch products therefore belonged to a different category from the open research that made the situation visible. The company could capitalize on the vulnerability without having originated it. This is a recurring pattern in security history: discovery, implementation, distribution, and monetization are separate stages, sometimes performed by separate groups.

SX OS was software, not a chip

SX OS was paid custom-firmware software sold through a licensing system. It was the software side of the offering, rather than a chip soldered into a console. Its commercial appeal included loading game backups, a feature that placed unauthorized copying at the center of the subsequent dispute. A purchaser was buying access to a maintained product and its interface, not ownership of the underlying security discovery.

That licensing model also marked a philosophical departure from Atmosphère. One project published an evolving open implementation; the other sold a convenient proprietary package. Both operated around a restricted console, but their distribution models, customer promises and relationship to the commercial game catalog differed. The distinction mattered to developers concerned with attribution as well as to Nintendo.

SX Pro: the external product for early hardware

SX Pro was a separate physical product aimed at compatible early Switch units. It was an external USB-C payload dongle associated with a jig or other physical recovery trigger and an SX OS license. The dongle helped automate or simplify the delivery process for users who already had eligible hardware; it did not discover the Tegra boot-ROM vulnerability and it did not turn every Switch into an equally modifiable machine.

That distinction is important because photographs and advertising encouraged people to treat the dongle as the whole achievement. In reality, its commercial value came from packaging a chain of circumstances: a vulnerable early processor, physical access, entry into the recovery path, software capable of taking advantage of the boot-ROM flaw, and a commercial interface that concealed much of that complexity from the customer.

SX Pro was not a soldered internal modchip. It was not a universal exploit for all Switch models. Its relevance depended on hardware eligibility, and later manufacturing changes made the original boot-ROM route unavailable on newer units. Describing it accurately also prevents a common chronological error: the paper-clip recovery technique and the SX Pro product were related through the same early hardware opportunity, but one was an improvised physical trigger and the other was a commercial accessory.

SX Core and SX Lite moved inside the machine

In 2020, SX Core and SX Lite moved the commercial offering inside the console. SX Core was an internal hardware product supporting particular Switch revisions, including hardware on which the original public recovery exploit was unavailable. SX Lite was designed for the Switch Lite. These were modchips, unlike the external SX Pro dongle.

These products are properly described as internal modchip hardware, unlike SX Pro. They belonged to a later phase of the business in which the commercial proposition involved altering or assisting the boot process from inside the console. The distinction is not merely vocabulary. It reflects the difference between selling an external accessory that helps an eligible machine reach a vulnerable recovery path and selling hardware intended to change the security situation on later machines.

The product progression also shows how security improvements redirect rather than necessarily eliminate a market. Nintendo could not rewrite the read-only silicon in early Erista units, but it could revise the processor and surrounding boot implementation in later hardware, including Mariko systems and subsequent models. Once the original weakness was closed in new production, commercial operators pursued a different technical boundary. Later hardware research, including high-level fault-injection work, belongs to that subsequent chapter and should not be confused with the original recovery-mode flaw.

The 2020 indictment and its allegations

On October 2, 2020, the United States Department of Justice announced charges against Max Louarn, Yuanning Chen, and Gary Bowser. The federal indictment alleged an eleven-count enterprise involving conspiracy, wire fraud, money laundering, trafficking in circumvention devices, and circumvention of technological measures. Prosecutors described a multinational operation using multiple identities, websites, products, and distribution channels.

The indictment associated the enterprise with products including SX OS, SX Pro, SX Core, and SX Lite. It alleged that the operation’s devices were designed and marketed to bypass Nintendo’s protections and enable users to play unauthorized copies of games. The government’s public language emphasized piracy and described the alleged business as having caused substantial losses to Nintendo and other video-game companies.

The indictment charged all three men; it did not convict them. Bowser’s later plea established a different procedural position from the allegations against Louarn and Chen.

The prosecution also presented different defendants as occupying different positions. Bowser was described as the public face and principal salesperson. That characterization does not make him the inventor of the relevant exploits or the technical discoverer of the Switch vulnerability. Louarn was described as a leader within the alleged operation, but “leader” does not mean that he personally wrote each software component or manufactured every device. Chen was charged as a participant; a charge alone does not establish a conviction or sentence.

This allocation of roles helps explain why the case was more complicated than the familiar image of one hacker defeating one company. The alleged enterprise depended on people who could build or source hardware, maintain online storefronts, communicate with resellers, handle payments, promote products, and serve customers. The public prosecution treated that network as a coordinated commercial operation rather than as an isolated act of technical research.

Bowser’s plea and the two different judgments

Gary Bowser pleaded guilty in October 2021 to two counts connected with trafficking in circumvention devices and conspiracy to circumvent technological measures and traffic in such devices. On February 10, 2022, Judge Robert Lasnik sentenced him to 40 months in federal prison. Bowser also agreed to pay $4.5 million in restitution to Nintendo of America in the criminal proceeding.

On December 7, 2021, Nintendo separately obtained a $10 million civil consent judgment and permanent injunction against Bowser. The criminal case’s $4.5 million was restitution; the civil case’s $10 million was a separate judgment. Together they were enormous obligations, but not a single $14.5 million criminal fine. A federal judge imposed the prison sentence in the United States’ prosecution, while Nintendo pursued its own civil remedies.

Another figure requires similar care. Government materials referred to more than $65 million in estimated losses to video-game companies. That was a government loss assertion used to describe the alleged impact of the operation. It was not Bowser’s personal profit, and it should not be repeated as though a court had found that he personally earned $65 million.

Bowser was released early in 2023. In subsequent interviews he described the financial pressure of the judgments and making payments despite limited means. Prison release ended one part of the punishment, not the civil debt. The scale of that difference helps explain why his case remained a story long after the sentencing headline: the software salesman could leave custody without leaving behind the financial consequences.

Max Louarn’s different path through Tanzania

Louarn’s story followed a different route. He was detained in Tanzania in 2020 while the United States sought his extradition. Contemporary reporting described a Tanzanian court rejecting the extradition request amid disputes about the arrest and procedure. Later accounts reported his departure through Réunion and return to France.

An extradition dispute asks whether a person may be transferred for proceedings elsewhere. It is not the trial of the underlying charges. Rejection of that request did not amount to an acquittal of the American allegations, but it also did not produce a conviction or a prison sentence equivalent to Bowser’s.

The established contrast is therefore between Louarn’s indictment and reported extradition history, and Bowser’s guilty plea and sentence. Yuanning Chen was also charged in the 2020 indictment. Neither man should be assigned Bowser’s admissions or punishment simply because their names appeared together in the original announcement.

MIG Switch was a cartridge impersonator, not another Atmosphère

At the beginning of 2024, MIG Switch brought the story back to the game-card slot. The product later used the MIG Flash name. Instead of selling an early-boot entry point, it offered a cartridge-shaped device whose removable storage could hold data for different games. Its apparent simplicity was the selling point: a different physical object, aimed at the interface players already used to insert a game.

The MIG Switch belongs to a different technological lane from Fusée Gelée, Atmosphère, and Team Xecuter’s software-centered products. It presents itself to the console as a game card and uses removable storage to select cartridge data. It does not, by its basic design, replace Horizon with Linux or boot a customized firmware environment. The closer historical comparison is a flash cartridge or cartridge emulator, not a boot-ROM exploit.

That distinction changes the security story. Team Xecuter’s SX products sought to alter the software or hardware environment in which the console operated. MIG sought to make the console believe that a substitute device was an authentic game card. The product could therefore be discussed alongside older flash carts, R4-style devices, and cartridge-copying tools without pretending that all of them used the same technical mechanism.

The MIG Dumper was a separate reader, presented as a way to extract a physical game card’s data. It was not the cartridge that went into the Switch. This separation explains the product family: one device read cards, while another attempted to reproduce their behavior for the console. Claims about making backups described a proposed use, rather than settling the legality of the surrounding sales or copying.

Identity data is the heart of the cartridge model

A genuine game card is more than a container of game files. It presents identity material associated with that physical cartridge, including data that networked services may use to distinguish one card from another. A cartridge emulator attempts to reproduce the expected relationship between content and identity while presenting different data through a substitute device.

A substitute cartridge must do more than provide a folder full of game assets. Content and card-specific identity material have to satisfy the expectations of the interface. That introduces a different security question from custom firmware: whether the card being presented is authentic and whether its identifying data is being reused in suspicious ways. It is not another instance of the Tegra recovery USB flaw.

A network ban is also not the same as physically bricking a console. Network enforcement can restrict online services or flag an account or device without necessarily preventing ordinary offline startup. Conversely, the absence of a reported ban does not demonstrate authorization, safety, or legality. The risk is part of the product’s technical model, not an incidental rumor.

Online enforcement adds another layer. Nintendo can make decisions about access to its services independently of whether a console can read a device locally. Reports of network restrictions therefore need to be distinguished from claims that a console has physically failed. A working offline machine and an account or console excluded from network services are different outcomes.

Why a cartridge loader did not replace custom firmware

A convincing game card can persuade a console to load content through an existing route. It does not automatically grant the privileges of a replacement kernel, provide a Linux environment or make arbitrary system services editable. The convenience of the cartridge form factor should not be mistaken for the breadth of control available after an early boot-chain compromise.

The distinction also explains why later cartridge products could be discussed in connection with newer hardware without establishing that the original Fusée Gelée bug had returned. Different products can reach a similar visible result through different trust boundaries. Loading something from a card slot says little by itself about whether the processor’s boot ROM is vulnerable.

MIG also prompted speculation about links to older commercial modding groups. Similar markets and reseller networks are not enough to establish shared ownership or inventorship. The technical comparison with SX products is useful; assigning MIG to particular Team Xecuter individuals without established evidence is not. The cartridge belongs in this history because of the boundary it challenged, rather than because a familiar name must secretly sit behind it.

The cartridge market reached the courts too

Nintendo’s later enforcement extended to sellers of modified hardware and cartridge devices. In 2024 it sued Ryan Daly over the Modded Hardware business. In 2025 the dispute ended in a reported $2 million stipulated civil judgment, alongside restrictions on circumvention-related activity. Daly was a seller in that dispute; the case should not be read as identifying him as MIG’s inventor.

In September 2026, Nintendo announced another result, this time from the District Court of The Hague involving a retailer’s sale of MIG cards and dumpers. Nintendo’s account described an order against offering and selling the devices. That was a separate civil development in a separate jurisdiction, not another sentence in the Bowser prosecution.

The practical thread is consistent even though the technology changed. A commercial business can face claims concerning the protection systems its products defeat, irrespective of whether the product looks like a chip, dongle or ordinary cartridge. The older arguments about private backups and owner control did not disappear. They met new devices, new evidence and the legal rules of the court hearing each case.

Nintendo’s lawsuit and the meaning of “ownership”

Nintendo’s civil judgment against Bowser expressed the platform holder’s position in a different register from the federal prosecution. Nintendo’s argument was not simply that one customer had altered a console. It was that commercial circumvention products could undermine the company’s control over game software, online services, distribution, and the economic expectations surrounding its platform.

From Nintendo’s perspective, a device marketed to make unauthorized game copies easy to run is not neutral merely because some customers might also use it for homebrew. The company invests in signed system software, game authentication, anti-piracy systems, and network infrastructure. A commercial product that defeats those controls can reduce sales, expose services to abuse, and encourage distribution of copyrighted games without permission.

The opposing argument begins with the buyer. A person who purchases a Switch may reasonably believe that ownership includes the ability to examine the machine, repair it, preserve its software, replace failed components, use accessibility tools, or run independent programs. Researchers need to test real hardware. Archivists worry about servers disappearing. Homebrew developers may want capabilities Nintendo never intended to support. Repair advocates resist the idea that a device becomes legally untouchable once a manufacturer has sealed its software.

The difficulty is that all of these interests can converge on the same technical boundary. An unsigned-code pathway cannot distinguish a preservation tool from a copied commercial game. A boot-chain modification cannot tell whether the next program is a Linux kernel, an emulator, an accessibility aid, a debugging utility, or an unauthorized copy of Breath of the Wild. The technology is indifferent; the surrounding conduct gives it meaning.

That is why legal analysis often turns on more than a tool’s theoretical capabilities. Design, marketing, licensing, support, distribution, and predominant use may all matter. The existence of a lawful use does not automatically legalize every device, just as the existence of infringing uses does not automatically make every homebrew project piracy. The line is contested, jurisdiction-specific, and shaped by statutes that were written at different moments in the history of digital technology.

From Game Genie to the Switch

The older Game Genie dispute helps explain why a product’s mechanism matters. Game Genie substituted data read by a game, producing effects such as extra lives or altered abilities. The American litigation addressed the resulting temporary alterations and the copyright questions they raised. It did not decide every later question about bypassing console authentication. Action Replay products likewise span different machines and mechanisms; the brand name alone cannot supply a legal answer.

Bleem’s emulator business raised another set of questions about compatibility and competition. The Dreamcast bleemcast! releases let supported PlayStation games run on different hardware, while Sony’s litigation against the company belonged to a broader battle over emulation. That history is a useful comparison, not a blanket judicial permission slip for cartridge loaders or modchips.

The Switch security episode inherited the vocabulary of all these earlier battles while adding modern complications. The platform was a general-purpose computer with a locked boot chain, an online ecosystem, downloadable software, encrypted and signed components, and a user community capable of building sophisticated open-source tools. The paper clip made the access path look almost comically simple, but the resulting dispute was not simple at all.

One side saw a manufacturer defending the integrity of a commercial platform. Another saw a customer reclaiming control over a computer concealed inside a game console. A third saw a market for products that converted research into convenience. The courts and prosecutors then had to distinguish research from trafficking, civil liability from criminal responsibility, and a defendant’s proven admissions from allegations made against people whose cases remained unresolved.

The comparisons to Game Genie, Action Replay, and bleemcast are useful only when they clarify those differences. They become misleading when they suggest that every modification tool has the same purpose or legal status. Console history is full of devices described as cheats, emulators, modchips, loaders, or accessories. Their names may sound similar; their mechanisms and legal consequences may not be.

What remains after the lock is replaced

The paper clip survives because it made a hidden architecture visible. It suggested that a premium game console could be brought to a vulnerable threshold with an object found in a desk drawer. But the real story was never the metal. It was the relationship between a recovery service, a flawed boot ROM, a USB attack surface, and a chain of trust that could be bypassed before the ordinary operating system took control.

It was also the story of what happens next. Researchers publish. Communities build. Companies package. Platform holders redesign. Copyright owners sue. Prosecutors indict. Courts distinguish pleas from allegations and civil judgments from criminal sentences. Users argue that buying hardware should mean more than renting a sealed experience, while manufacturers argue that the software ecosystem requires enforceable boundaries.

The Switch did not produce a final answer to that argument. It produced a particularly vivid question: when a machine belongs to the person holding it, how much authority should remain with the company that made it? The paper clip revealed the weakness in Nintendo’s first lock. The courtroom revealed the cost of turning that weakness into a business. And the lasting legacy is not that one side permanently won, but that security, ownership, preservation, and copyright became impossible to discuss as separate subjects.

Explore our histories of Game Genie, Action Replay and bleemcast!. For the games themselves, follow our Breath of the Wild and Tears of the Kingdom walkthroughs.