Nintendo has never sued an individual for using TagMo or the encryption key. However, they have:

Disclaimer: This information is for educational and preservation purposes only. Verify your local laws regarding DRM circumvention.

If you own an Android phone and a pack of NTAG215 cards (cost: ~$1 each), here is the theoretical workflow:

The result is a coin-sized sticker that your Switch reads exactly like a $15 plastic statue.

For the first two years of amiibo's life, the key was secure. Hackers could read NFC data, but they couldn't write new, valid amiibo data without breaking the authentication.

The breakthrough came in 2016, not through math, but through corporate failure. A group of reverse engineers discovered that Nintendo’s official "amiibo API" (used by game developers to interact with the figures) contained a fatal flaw. Specifically, a debugging tool or a development version of a game (rumored to be an early build of Animal Crossing: amiibo Festival) left the encryption keys accessible in memory.

The user known as "socram8888" (a prominent figure in the Wii U hacking scene) managed to extract the key from a retail Wii U game binary. They didn't break AES-128 (which is unbreakable via brute force). They simply read it out of the software that had to use it.

On September 8, 2016, the key was publicly posted to the GBAtemp forums. The reaction was seismic. Within 24 hours, the first open-source amiibo emulator, "TagMo," was updated to write fully valid amiibo data to blank NTAG215 chips.

To understand the encryption key, you must first understand the chip.

Every amiibo contains an NTAG215 NFC (Near Field Communication) chip. This is a standard off-the-shelf component made by NXP Semiconductors. Critically, standard NTAG215 chips have a fixed memory layout: 540 bytes of user memory divided into 135 pages (4 bytes each).

The data on an amiibo is split into three distinct layers:

Nintendo did not just write plain text to these chips. They implemented a sophisticated security system using a AES-128-CMAC (Cipher-based Message Authentication Code). Without the correct key, the console cannot verify that the data hasn't been tampered with.

Under Section 1201 of the DMCA, it is illegal to circumvent "technological protection measures" (TPM) that control access to a copyrighted work. Nintendo has successfully argued in the past (notably against rom site creators) that encryption keys qualify as TPMs.

Is it illegal to possess the key? Probably not. Keys are numbers. You cannot copyright a number. Is it illegal to use the key to write a blank card? Likely yes, in the US and Japan. You are circumventing the authentication measure to create an unauthorized derivative work (the digital data of the amiibo).

In 2016, a member of the GBAtemp hacking community (known as “socram8888”) made a breakthrough. By analyzing how a 3DS communicated with an amiibo, they performed a RAM dump—capturing the console’s live memory while it read a figure.

Inside that memory dump, the AES key was sitting in plaintext.

Once published, the floodgates opened. Tools like TagMo (Android), amiitool, and Thenaya let anyone decrypt, modify, and re-encrypt amiibo data on a standard PC or phone.