The hacking community has been busy lately, with news breaking on the 26th of October that some people managed to decrypt the special Pokémon files that make up X & Y. Since then, curious Pokémon pictures are circulating of Pokémon that are not actually currently available in X & Y.
The question on a lot of people's mind right now is, are these real? Kotaku can confirm that this is indeed the case. If you don't want to be spoiled on what these Pokémon are, I suggest you stop reading now!
Here is a picture of the three mysterious new Pokémon—Diancie, Volcanion and Hoopa:
A Kotaku source who is responsible for these images was able to prove their veracity to me by providing an additional screenshot that contained the Pokedex entry for Diancie, a rock/fairy type Pokémon. The source declined from letting me show you the image, but the game classifies Diancie as a 'Jewel Pokemon.' Its Pokedex entry is as follows:
It can instantly create many diamonds by compressing the carbon in the air between its hands.
The source says all three of these Pokémon, although not accessible through normal means, were already in the game. In order to access them, he had to "patch the game's data on the fly," allowing the hacker to come across new, previously unannounced Pokémon via random encounters.
The existence of these Pokémon was rumored before the hacks, as popular Pokémon news website Serebii had published pages mentioning all three. Kotaku reached out to Serebii, who told us that they uploaded the information about the new Pokémon to their site, but it was meant to be hidden from public view until Nintendo publicly announced the Pokémon. Somehow, the pages containing the new information became public last week. However, Serebii quickly took the pages down. A Serebii webmaster told me that they were willing to remove their listings of the new Pokémon because earlier run-ins with the gaming giant nearly shut the site down.
"Back in 2010, [we] reposted images of the entire Pokémon roster which turned out to be from an alpha build. Nintendo was unhappy with that and sent a cease and desist that almost resulted in [the] site getting shut down. Since then, [we] have been so unbelievably skittish in regards to posting leaks," a Serebii webmaster said.
We have contacted Nintendo to ask both about the hacking and newly-discovered Pokémon, as well as about the cease and desist against Serebii.
UPDATE: The Pokemon Company tells Kotaku that they have "nothing to report at this time."
(The old Serebii pages, before they were brought down. Images via Smogon user zferolie.)
Kotaku cannot confirm if these new Pokémon are legendary Pokémon, but the popular assumption at the moment is that they are, at the very least, 'event Pokémon.' Event Pokémon are special Pokémon that Nintendo distributes at promotional events, like film releases. Event Pokémon are not attainable through normal means, just like these three new Pokémon. And, although not always the case, historically, most event Pokemon are legendary Pokémon.
It's worth noting that a few other images have started circulating recently, of other newly-found Pokémon—such as Mega Latios and Latias, new colors of Vivillion, and the special Pokémon belonging to a key character in the story. It's possible that the three event Pokémon found recently are not the only new Pokémon hidden in the game's code.
The other big elephant in the room about this news is the fear that the Global Trading System used to transfer Pokémon between trainers is now full of 'fake' hacked Pokémon somehow injected into the game via dubious means—as this was a huge problem in previous generations. However, as of this writing, hackers have not actually found the means to inject Pokémon back into the game from a PC.
The Kotaku source responsible for finding the new Pokémon in the game also says they "suspect Nintendo put some checks in place to make sure the Pokémon are valid." This hunch is compounded by the fact that earlier this year, when Pokémon Bank was announced, The Pokemon Company warned players that any Pokemon created through illegal means could not be uploaded to their servers. And in case you're wondering: those people asking for Diancie, Hoopa and Volcanion for trading on GTS can do so because X & Y allow you to insert the names of anything you'd like. Try it out.
Additionally, not all hacking is done with the purpose of circulating 'fake' Pokemon—in earlier generations, hacking allowed players to understand the mechanics behind obtaining shiny Pokemon and breeding.
Pokemon leaks have proven to be a problem this year thanks to Japanese magazines scans hitting the web before they were supposed to, as well as some players managing to get the X & Y in advance. The entire point of a worldwide release according to The Pokemon Company was an effort to maintain some of the game's mystique. In prior iterations, the games would release in Japan first—causing many of the game's secrets to circulate the web before Nintendo properly revealed them.
Thanks for the tip, Mike and Bobsplosion!