DEF CON 34 ships Bunnie Huang's open-source Baochip as its badge

The badge you get walking into DEF CON 34 this year is not a piece of PCB art with a novelty LED pattern. As Wired reports, it is Andrew 'bunnie' Huang's Baochip-1x, an open-source system-on-chip that the badge treats as a hardware security token, password manager, HSM, and, yes, pretty light generator.

What makes it more than a hacker-conference gag is how far the openness reaches. The Baochip-1x pairs a 350 MHz Vexriscv RV32-IMAC core with a four-core, 700 MHz PicoRV I/O accelerator, 4MB of ReRAM and 2MB of SRAM, and it bundles the kind of hardware secure elements you would expect on a commercial secure MCU: cryptography accelerators, a key store, one-way counters, a true random number generator and hardware attack countermeasures. In Huang's own writeup, the design is described as 'mostly open,' with the entire bootloader open-source and NDA-free and most of the compute-logic design source open and NDA-free. It is fabricated on TSMC's 22nm process, and the package is deliberately engineered for Infra-Red In-Situ (IRIS) inspection, so an owner can look through the silicon non-destructively and confirm the transistor pattern matches the published RTL.

Why this matters in a year where every AI infrastructure conversation eventually lands on 'who do you actually trust to make your chips': Baochip is a working existence proof that a supply-chain-transparent secure element can ship in real volume, not only as a paper design. It ties the physical inspection story to a public bootloader, and the follow-on Dabao dev board is being crowdfunded at a $9.50 pledge with shipping targeted for June 2026, which is what platform ambition here actually looks like on the ground.

The honest caveat is that 'mostly open' is not 'fully open,' the IRIS workflow is not obviously scalable beyond a motivated auditor, and the reporting does not show an independent inspection actually catching a fault in a shipped part. What the coverage also does not give you is production economics past the badge run or which fab node comes next. But the direction is what leaders in high-assurance embedded and hardware security should be tracking, because the RFP phrase 'attestable from silicon to bootloader' just got a reference implementation to point at.