This is easily in my top five, but the hack that had me buzzing all night with its cleverness when I read about it is Nils Schneider's method of extracting the ipod bootloader:

http://www.newscientist.com/article/dn7085

Seconded. Hands down the most sophisticated hack I've seen in my life. I am absolutely amazed that something like this is possible.