SMART Play (SMART Brick)
The SMART Brick is a 2x4 brick built around a custom mixed-signal chip LEGO calls smaller than a stud, with an accelerometer, a light sensor, a sound sensor, a speaker with a synthesiser behind it and wireless charging, announced on 5 January 2026 and on shelves from 1 March 2026 beside passive SMART Tags and SMART Minifigures. It hears none of the links in How the links work: undocked bricks talk to each other on an encrypted Bluetooth channel of LEGO's own, and tags are read over NFC through the same coils that charge the brick.
Reach
| Capability | State | Note |
|---|---|---|
| Read battery, volume, model, firmware and MAC address over Bluetooth GATT | works, untested here | only while the brick sits on the charger |
| Set volume, rename the brick | works, untested here | docked only, same GATT service |
| Clone an existing SMART Tag | works, untested here | byte-perfect onto blank ISO 15693 stickers from another vendor |
| Author a new SMART Tag | out of reach | payload is AEAD-encrypted, 128-bit key in silicon |
| Drive play behaviour from outside | out of reach | no path found off the charger |
| Firmware update, factory reset | out of reach | gated by ECDSA P-256 against LEGO's signing server |
| Speak BrickNet, from a browser or the bridge | out of reach | Bluetooth LE 5.4 PAwR, and the session is keyed inside the brick |
What it hears
Nothing on the list in How the links work — no infrared, no visible light — and the Bluetooth it speaks is not LWP3, so a Powered Up client finds no service it recognises. Two radios, and both are shut.
BrickNet. Undocked bricks talk to each other over Bluetooth LE 5.4 Periodic Advertising with Responses (PAwR) on an EM Microelectronic EM9305. The internal name shows in firmware filenames: bnet_coord.c, bnet_resp.c, jam_bricknet_transport.c. One brick becomes coordinator and peers answer in assigned slots with 25-byte packets. Sessions are AES-encrypted, and a 16-byte key authenticates the EM9305 to the brick's ASIC. LEGO has published nothing about it.
NFC. SMART Tags and Minifigures are passive ISO/IEC 15693 (NFC Type 5) transponders at 13.56 MHz on a custom EM die: UID prefix E0:16, IC ref 0x17, 66 blocks of 4 bytes, 264 bytes in all. The RF layer runs through the same ASIC and the same copper coils used for wireless charging. Tag memory reads with no authentication whatever — no password, no page protection, no privacy mode — and the brick validates the data blob, not the UID, which is why a copy onto somebody else's sticker passes. The payload itself is authenticated-encrypted, and bit-flip tests confirm full AEAD, so a tag can be duplicated but never forged.
Reaching it today
On the charger, any Bluetooth central: the docked brick exposes a plain GATT service that reads its state and takes a new volume or name. node-smartplay is the working client.
Over NFC, any ISO 15693 reader: the 264 bytes come out with no authentication and go onto a blank sticker the brick then accepts. This is the one tractable angle.
Nothing else. Flash Force does not reach the brick, and the bridge does not change that — it sends infrared, it flashes light, and it connects over Bluetooth as a central, and BrickNet is none of the three.
Links
- Announcement: lego.com · range and prices: lego.com/smart-play. Sold only in "All-in-One" sets: cheapest entry 75421 Darth Vader's TIE Fighter, $69.99.
- Best public research: nathankellenicki/node-smartplay (npm v1.0.0, 3 Mar 2026) — its
research/directory is the reference. - NFC toolkit: marcinruszkiewicz/lego_smart_brick. Its Grain-128A decryption attempt failed — 320 bits of keystream leave the key unrecoverable.
- Both repositories are listed in Link directory.