For more than a decade, the Xbox One was the console the hacking scene couldn’t crack. The PlayStation 3, the Wii, the Switch and the original Xbox all fell eventually. The Xbox One, launched in 2013, held out. That changed in March 2026, when security researcher Markus “Doom” Gaasedelen showed a hardware attack he calls Bliss at the RE//verse 2026 conference. It compromises the console’s boot ROM, the first code that runs when the machine powers on, and Microsoft can’t fix it with a software update.
Some early coverage made it sound as if every Xbox One could now be modded at home and flooded with pirated games. That isn’t what happened. Here’s what Bliss actually does, why it’s a big deal for security engineers, and what it realistically means for people who own the console.
Why the Xbox One held out so long
Microsoft built the Xbox One on the assumption that attackers would have physical access to the hardware and unlimited time. That’s a harsher threat model than most consumer devices use, and the company talked about it openly. In 2019, Microsoft’s Tony Chen gave a talk at the Platform Security Summit called “Guarding Against Physical Attacks: The Xbox One Story”. It walked through the design: a dedicated security processor, encrypted and signed code at every stage of boot, a hypervisor that separates games from the system OS, and countermeasures against the tricks that broke earlier consoles.
Microsoft engineers were confident enough to describe the Xbox One as the most secure product the company had ever produced. There was also less reason to attack it than earlier consoles. Since 2016, Microsoft has offered a Developer Mode that lets owners run their own apps and, for a while, emulators. That removed one of the main motivations behind homebrew hacking.
What Bliss actually is
Bliss is a voltage glitching attack, a type of fault injection. The idea is old and simple, even if doing it is not. Chips need a stable supply voltage to execute instructions correctly. If you briefly pull that voltage down at exactly the right moment, the processor can misbehave in useful ways. It might skip an instruction, read the wrong value or ignore a check.
According to Keysight’s technical write-up of the talk, the attack targets the power rail feeding the security processor during early boot and works in two stages:
- First glitch: skips the loop that configures the memory protection unit (MPU). Without that protection in place, memory the boot ROM assumes is locked down isn’t.
- Second glitch: corrupts a memory copy operation while the boot ROM reads a bootloader header. That lets the attacker redirect execution to data they control.
Each glitch reportedly succeeds around 1% of the time, so both landing in the same boot is roughly a one-in-10,000 event for a given set of timing parameters, and finding the right parameters in the first place took an enormous number of automated attempts. Gaasedelen couldn’t see inside the chip directly, so he used side channels such as power traces and I/O signals to work out where in the boot process the processor was, then let automated hardware reboot the console over and over.
That’s why some coverage calls it a “double glitch”. Either glitch alone isn’t enough. Both have to land in the same boot.
Why it can’t be patched
The boot ROM is burned into the silicon at the factory. It’s deliberately immutable, because the whole chain of trust starts there: the ROM checks the next stage, which checks the next, and so on up to the operating system and games. That immutability is a strength until someone finds a flaw in the ROM itself. Then it becomes permanent.
Once the boot ROM is compromised, everything above it can be replaced. As Tom’s Hardware reported, the attack allows unsigned code to run at every level, including the hypervisor and the operating system, and gives access to the security processor that handles decryption of firmware and games. No firmware update can remove a flaw in read-only silicon.
This is the same class of problem that made the Nintendo Switch’s original Tegra X1 chip permanently hackable in 2018. The fix, in both cases, is new hardware.
Which consoles are affected
According to WinBuzzer’s analysis, the attack was shown on the original 2013 Xbox One. Later hardware, the Xbox One S, Xbox One X and the Series X|S, reportedly uses a hardened boot ROM with circuitry that detects voltage glitches. As of the talk, there was no public demonstration against those models. That matches the pattern Chen described in 2019: Microsoft kept adding physical-attack countermeasures to newer chip revisions.
What it means for owners
Less than the headlines suggested, at least for now.
- It’s not a software hack. You can’t run it from a USB stick or a website. It needs the console opened up, wires soldered to the motherboard, components removed and a microcontroller timing the glitches.
- It’s slow and unreliable. Reports describe long runs of automated attempts before a successful boot.
- No public tool or modchip has been released. Gaasedelen presented the research, not a product.
- Online play is a different matter. A modified console that connects to Xbox network services would very likely be detected and banned, as happened on earlier platforms.
Could someone eventually automate it into a modchip? Possibly. That’s how earlier hardware attacks, such as the Xbox 360’s reset glitch hack, reached hobbyists. But it would take significant engineering, and it would only ever work on the oldest Xbox One units.
Who actually benefits
The most interesting uses are about preservation, not piracy. Gaasedelen has framed the work that way. Access to the boot chain and security processor means:
- Repair: recovering consoles that are bricked by failed updates or dead internal drives, which currently can’t be fixed without Microsoft’s tools.
- Archiving: dumping system firmware and understanding it before these machines stop working and the online services behind them shut down.
- Emulation research: understanding exactly how the hardware behaves, which future emulators will need.
A note on the law: in many countries, including under the US DMCA, circumventing copy protection can be illegal even on hardware you own, with limited exemptions. Modifying a console will also end any warranty. If you’re interested in this area, following the research is fine. Doing it yourself is a decision to make carefully.
The lesson for security engineers
The bigger story isn’t about games. The Xbox One was one of the few consumer devices designed from the start to resist physical attacks, and its defenders did most things right. It still took only one overlooked fault path in early boot code to undermine the whole chain of trust.
Keysight’s summary puts the takeaway well: physical attack resistance must be validated, not assumed. For anyone designing hardware today, whether car electronics, payment terminals or IoT devices, that means:
- Treat boot ROM code as the highest-risk code you ship, because you can never fix it.
- Add hardware glitch detectors and redundant checks for critical decisions, such as verifying a signature twice in different ways.
- Run structured fault injection testing on real silicon before tape-out is final, not just code review.
- Design so that a compromise of one device doesn’t compromise every device, for example by using per-device keys.
Microsoft seems to have learned those lessons already, which is why the newer consoles are reportedly unaffected. The original Xbox One, though, has joined a long list of consoles showing that “unhackable” is a claim about today’s attackers, not tomorrow’s.
Related reading
- The FCC’s Foreign Router Ban Explained
- Motorola and GrapheneOS: What the Partnership Means
- UNC3886 Inside Singapore’s Telcos
Sources: Tom’s Hardware, Keysight, WinBuzzer, Platform Security Summit 2019.
