Security

She Found a Bricked Cricut in E-Waste and Unlocked It with a $1 Raspberry Pi Chip

Cricut remotely deactivates machines — for warranty replacements, for on-selling, sometimes just for loaning to a friend. When Australian hacker xssfox found a locked Cricut Maker in e-waste, she bypassed the cloud lock with a $1 RP2040 microcontroller acting as a USB proxy: Wireshark revealed the serial number travels in plaintext with no encryption or checksum. Full story, the security implications, and the right-to-repair context.

Keeping this site alive takes effort — your support means everything.
無程式碼也能輕鬆打造專業LINE官方帳號！一鍵導入模板，讓AI助你行銷加分！ 無程式碼也能輕鬆打造專業LINE官方帳號！一鍵導入模板，讓AI助你行銷加分！
Author Editorial Team Published Read 4 min read
She Found a Bricked Cricut in E-Waste and Unlocked It with a $1 Raspberry Pi Chip

Key takeaways

  • xssfox found a Cricut Maker in e-waste (perished rollers were why it was trashed), and it was cloud-locked: self-tests passed, but Design Space showed 'Machine deactivated.' Cricut is known for remotely deactivating machines — after warranty replacements, when machines are on-sold, and reportedly even for loaning to a friend.
  • The unlock: Wireshark capture of the USB CDC link showed the serial number travels in plaintext — no checksums, no cryptography. A Raspberry Pi RP2040 (overclocked to 240MHz) acting as USB host+client proxy rewrites the serial in-flight, and the machine registers and works as new. The proxy even lets you register serial numbers that don't exist.
  • Cricut's bricking history: March 2021 subscription backlash (20 uploads/month cap) reversed in 3 days; warranty replacements lock the old machine and support tells users to throw it away ('turn it into a flower pot'); a firmware update bricked a loaned machine permanently; help desk chats stated Cricut bricks devices sold second-hand.
  • Security implication: because serials are sequential and queryable on Cricut's status page, the same unencrypted system could let a stranger lock out or register other users' machines — a collateral vulnerability the author deliberately flagged.
  • Legal context: xssfox withheld the code citing Australian anti-circumvention law; the Productivity Commission's 2021 right-to-repair report recommended clarifying TPM circumvention for diagnosis/repair; in the US, EFF has won DMCA 1201 exemptions for repair, and continues to litigate against the provision itself.

Key answers

Why do Cricut machines get locked/deactivated?

Cricut uses cloud DRM to deactivate machines remotely. Documented triggers include: warranty replacements (the old machine is deactivated before the replacement arrives, leaving users stranded 7-14 days), on-selling or transferring a machine (a loaned Maker was permanently bricked by a firmware update when a friend created a new account), and second-hand sales (help desk agents stated devices would be bricked). Cricut often tells users to throw deactivated machines away rather than return them.

How did xssfox unlock the e-waste Cricut?

The machine passed self-tests but showed 'Machine deactivated' in Design Space. After finding no EEPROM to rewrite and hitting certificate pinning on the network side, she captured the USB CDC link with Wireshark and found the serial number is sent in plaintext with no checksums or crypto. She built a proxy with a Raspberry Pi RP2040 (overclocked to 240MHz, using TinyUSB host+CDC examples) that sits between cutter and PC and rewrites the serial number in-flight. The software then sees an active serial, and the machine registers and works as new — rollers replaced (hot water trick) and a 3D-printed case later.

What was the Cricut Access backlash of 2021?

On March 12, 2021, Cricut announced non-subscribers would be capped at 20 image uploads per month (subscription: $9.99/month). Hobbyists and Etsy sellers exploded — the machines cost $180-400+ and the cap retroactively paywalled hardware they owned. After 3 days of fury (class-action talk, ACCC complaints), CEO Ashish Arora reversed: first 'grandfathering' unlimited uploads for pre-2022 accounts (March 16), then full capitulation (March 18) — unlimited free uploads for everyone, forever.

Is unlocking a locked device legal?

It's a legal grey area. In the US, DMCA §1201 generally bans circumvention, but the EFF has won exemptions covering repair of digital devices, home appliances, and vehicles — and continues to argue the provision itself is unconstitutional. In Australia, the Productivity Commission's December 2021 right-to-repair report recommended amending the Copyright Act to permit TPM circumvention for diagnosis and repair. This ambiguity is why xssfox published the story but withheld the code.

What's the security implication of the plaintext serial?

Because Cricut serial numbers are issued sequentially and the status of every unit is queryable on Cricut's own status page, the lack of authentication on the USB serial link means a malicious party could theoretically register active serial numbers to their own account, or lock out other users' machines. xssfox demonstrated registering serial numbers that don't exist on the status page.

She Found a Bricked Cricut in E-Waste and Unlocked It with a $1 Raspberry Pi Chip

In July 2026, Australian security researcher xssfox was taking out the rubbish when she spotted a Cricut Maker in e-waste — a $400+ cutting machine, cosmetic condition fine except for perished rollers, which were probably why it was thrown away.

She took it home. It passed self-tests. Then Design Space greeted her with the message that haunts the Cricut community:

“Machine deactivated”

Cricut is notorious for remotely locking its machines. But xssfox — a hacker — decided the lock was a puzzle, not a verdict. What followed is one of the cleanest hardware bypasses of 2026: a $1 microcontroller that rewrites your printer’s identity in-flight.

Why machines get bricked in the first place

Cricut’s cloud DRM deactivates machines for reasons that have enraged users for years:

  • Warranty replacements: the old machine is remotely deactivated before the replacement arrives — leaving home businesses without a working cutter for 7-14 days
  • Support tells you to trash it: instead of returning the deactivated unit, users report being told to throw it away, “turn it into a flower pot,” or keep it as a display piece
  • On-selling and loaning: a Reddit user loaned their Maker to a friend; the friend created a new account, Design Space pushed a firmware update, and the out-of-warranty machine was permanently bricked. Cricut refused to unbrick it
  • Help desk statements: support chats circulated showing agents saying devices would be bricked if sold second-hand

The 2021 precedent made the pattern undeniable: in March 2021, Cricut tried capping free users at 20 uploads/month, the community exploded (Etsy sellers, class-action talk, ACCC complaints), and CEO Ashish Arora reversed course twice in three days — ending with unlimited free uploads for everyone, forever.

The unlock: plaintext serials and a $1 proxy

xssfox’s attack surface of choice wasn’t the cloud — it was the cable.

  1. Wireshark on the USB CDC link → the cutter sends its serial number to the computer in plaintext. No checksums. No cryptography.
  2. A Raspberry Pi RP2040 (the $1 chip from the Pico), overclocked to 240MHz, acting as USB host + client simultaneously (TinyUSB examples, CDC echo)
  3. The RP2040 sits between cutter and PC, and when it sees the serial packet, rewrites it to a different, active serial number

The software is none the wiser. The deactivated e-waste unit registers in the user’s account and works as if brand new — after replacing the perished rollers (hint: hot water softens them) and 3D-printing a little case for the RP2040.

The collateral vulnerability she flagged

Here’s the uncomfortable part: Cricut serial numbers are issued sequentially, and the status of every unit is queryable on Cricut’s own status page. xssfox could register serial numbers that don’t exist on that page.

Which means — as she carefully noted — the same unencrypted system could allow a stranger to register active users’ serials to their own account, or lock out other people’s machines. The lock that protects Cricut’s business model doesn’t even protect its customers from each other.

xssfox published the full story but withheld the code, citing Australian anti-circumvention law. The context:

  • US: DMCA §1201 bans circumvention, but the EFF has won exemptions for repairing digital devices, appliances, and vehicles — and keeps litigating against the provision itself
  • Australia: the Productivity Commission’s December 2021 right-to-repair report recommended amending the Copyright Act to permit TPM circumvention for diagnosis and repair
  • The consumer path: during the 2021 controversy, Australian law made retailers jointly liable — Harvey Norman refunded full AUD$600 purchases

Why this matters

This is e-waste rescue as security research. A machine Cricut considered dead — killed by a server-side flag, not any hardware fault — was returned to full function with a $1 chip and an afternoon.

It also proves something the right-to-repair movement has argued for years: these locks are artificial. They exist to protect business models, not to protect users — and when the “protection” is a plaintext serial number on a USB wire, the business model is exactly as strong as the cable it ships with.

The flower pot can cut again. ✂️

Tags
Cricut right to repair reverse engineering e-waste RP2040 hardware hacking DRM consumer rights USB