Well-known console cracker gezine_dev pointed out that "the SDK is bundled with the game" rather than being built into the operating system. The cracking operation demonstrated this time actually involves "extracting the Switch 1st-gen binary files from the cartridge."
Security researcher invokertr posted video clips on the X platform, showcasing a new security vulnerability he discovered in the latest 23.5.0 firmware version of the Switch 2. He claimed to have fully exported the European version files of the host's latest Software Development Kit (SDK), as well as the complete data of the latest firmware.
Nintendo pushed the Switch 2 firmware update to version 23.5.0 on November 10, 2026. This update fixed the operating system vulnerability previously exploited by the ns2jb jailbreak tool, which allowed device jailbreaking on firmware version 23.0.1. The current SDK leak means that Nintendo's new development tools are now fully exposed, allowing external parties to continue reverse engineering, as well as developing emulators and re-compiling work for future Switch 2 games.
The hacker joked, "The design concept of the hybrid operating system is great, but Nintendo's security is lacking." This remark alludes to Nintendo's underlying system architecture; while he superficially acknowledged the manufacturer's system software design, he was actually mocking its security protection level.
Some netizens urged him to wait until games like Metroid: Greed and Xenoblade: Genesis are released before disclosing the vulnerability. This security researcher explicitly stated that he will not release the cracking tools until "HackerOne's bug bounty program offers a reasonable compensation plan." This statement likely refers to his plan to apply for a bug bounty from Nintendo through this cybersecurity platform.
Another security researcher known for the PS5 jailbreak project, Sonic_Iso, voiced strong support for invokertr, stating that his disclosures have "extremely high credibility."
Recent reports indicate that Nintendo has remotely blacklisted two games, SmileBASIC 4 and Civilization VII, via the BCAT push feature or background updates that do not require a reboot in the 23.0.1 firmware version. Both titles are known entry points for vulnerability exploits. Meanwhile, this incident also exposed risks associated with the 90DNS tool when IPv6 is enabled: the Switch 2 may bypass preset access restrictions and still connect to Nintendo's official servers through the IPv6 domain name resolution service provided by the router.