A $200 glitch rig turned a crippled A100 mining card into a full GPU

What happened

A security researcher writing at blog.kate.land published a detailed walkthrough of using voltage glitching to unlock an NVIDIA CMP-series card — the mining-only variants NVIDIA shipped during the 2021 crypto surge — and recover the full compute capabilities of the A100 die underneath. The CMP line was NVIDIA's attempt to shunt miners away from gamer GPUs: same silicon in many cases, but with display outputs removed, PCIe bandwidth halved, and crucially, compute performance fused off so the chips couldn't be repurposed for ML workloads after the mining bubble popped.

The author's setup is almost comically modest for what it accomplishes. A ChipWhisperer-Husky handling the trigger and glitch timing, a MOSFET on the GPU's core voltage rail, a logic analyzer, and a lot of patience iterating glitch width and offset until the fuse-read sequence at boot got corrupted in just the right way. The attack doesn't break any cryptography and it doesn't exploit a firmware bug — it exploits the physics of CMOS logic, which assumes a stable supply voltage during state transitions.

The payoff: after enough glitch attempts, the card boots as if it never read the restriction fuses, and the full A100 feature set — tensor cores, higher memory bandwidth, the works — comes back online. The writeup includes scope traces of the glitch pulse, the exact timing window relative to the power-on reset, and photos of the janky-but-effective bench setup.

Why it matters

Silicon market segmentation via fuses is everywhere. It's how Intel sells the same die as an i5 or an i7, how NVIDIA sells the same GB100 as an H100 or H200 variant, and how AMD sells Zen cores with varying cache sizes. The industry assumes that once a fuse is blown, the decision is permanent and the segmentation holds. Voltage glitching is a reminder that 'permanent' is doing a lot of work in that sentence.

The technique itself is not new. Fault injection against secure boot has been a known attack class since at least the mid-2000s, and ChipWhisperer has been the hobbyist's reference platform for a decade. What's striking here is the target: not a smartcard, not a game console, not a locked bootloader on a phone — a high-end datacenter accelerator. The economics flip the usual threat model. A console modder is trying to run pirated games; the person glitching an A100 is potentially unlocking tens of thousands of dollars of inference capability from hardware that sells used for a fraction of that because nobody wants a crippled mining card.

Community reaction on Hacker News split along predictable lines. Hardware security folks noted that NVIDIA almost certainly knows this is possible — glitch resistance (redundant fuse reads, voltage monitors, delay-and-recheck patterns) is a well-understood countermeasure, and the CMP line clearly didn't justify the BOM cost of hardening. Others pointed out the ethical gray zone: you bought the silicon, is extracting the performance NVIDIA tried to hide really wrong? And a smaller contingent flagged the genuine risk — datacenter operators buying 'suspiciously cheap A100s' off eBay may be buying glitched CMPs that will fail validation or behave unpredictably under production load.

The deeper point is about trust boundaries in silicon. When NVIDIA sells you a CMP, they're asserting that the fuse configuration is the ground truth. But ground truth lives in transistors that need a clean voltage rail to behave deterministically. Anyone with physical access and a few hundred dollars of gear now owns the fuse-read step, which means they own the segmentation. The only real defenses are either (a) make the glitch window so narrow and so well-protected that the attack cost exceeds the hardware's value, or (b) move the trust root to a signed, external attestation that NVIDIA controls — which is exactly where confidential-compute GPUs are heading.

What this means for your stack

For most developers, this is a curiosity, not an action item. You are not going to buy a used CMP and glitch it — the yield rate is low, the cards are aging, and if you have actual inference workloads to run, the opportunity cost of bench time dwarfs the savings. If you see 'cheap A100' listings on the secondary market at prices that look too good, assume they're either glitched CMPs or stolen, and either way, don't put them in production.

The more practical takeaway is for anyone building on top of hardware-attested compute. Confidential computing on GPUs (NVIDIA's CC mode, AMD's SEV-SNP with GPU passthrough) ultimately relies on the GPU attesting to its own configuration. That attestation is cryptographically signed, but the signing key and the measurement logic live on the same die whose fuses can — in principle — be manipulated. The CMP unlock is a far cry from extracting an attestation key, but it's the same family of attack, and it's a useful prompt to ask your vendor exactly what hardening sits between a glitched power rail and a forged attestation.

For security engineers, the writeup is simply a great teaching artifact. The methodology — characterize the target, find the vulnerable window, iterate glitch parameters, verify success — is identical whether you're attacking a smartcard or a $10K accelerator. If you've never watched someone narrow a glitch window from milliseconds to nanoseconds, read the post for the trace analysis alone.

Looking ahead

Expect the next generation of datacenter GPUs to take this class of attack more seriously. Blackwell and successor architectures are already adding voltage monitors, redundant fuse reads, and signed microcode checks that cross-validate the configuration at runtime — not because anyone is glitching H100s in bulk, but because confidential compute is now a product line, and the attestation story falls apart if the fuses are negotiable. The CMP unlock will probably be remembered as the last era where silicon segmentation was enforced by hope and a single fuse read. The next era will cost attackers more, and will cost vendors a lot more die area to defend.