> The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip.

Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.

With hardware wallets (aka substantial incentive), then the attackers could order a bunch of them for sacrificial zero-ing in the exact places to drill with a CNC/microscope/etc.

> Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.

Yes, initially I had just the one. But once I had it figured out there were lots of other people that wanted their device 'improved' so that jig got used plenty of times. Even so working on other people's hardware always felt very scary, especially poking around with a drill in a sensitive piece of hardware. Even so, they all worked, it was a neat little trick.