What are Bitcoin puzzles?

Key points

• Bitcoin puzzles are 75 wallets that hold 969 BTC (~$29.4m at the time of publication).
• Anyone can claim the coins by finding the private keys.
• Creating similar games is not particularly hard.

Who created Bitcoin puzzles, and when?

On January 15th 2015, an anonymous user distributed 32.9 BTC across 256 addresses: the first received 0.001 BTC, the second 0.002 BTC, the third 0.003 BTC, and so on, up to 0.256 BTC.

Bitcointalk users noticed these transactions and spotted a pattern — the private keys to the addresses, in binary form, began with zeros, whose count decreased step by step:

• key to the first address — 0…00000000001, one random bit;
• key to the fourth address — 0…00000001000, four random bits;
• key to the ninth address — 0…000111010011, nine random bits.

The project’s author remains unknown, but the puzzle-maker occasionally resurfaces. In 2017 he moved bitcoins from addresses no. 161 to no. 256 to the ‘lower-numbered’ addresses — most likely because brute-forcing a key longer than 160 bits is infeasible in the foreseeable future.

Why are the addresses called puzzles?

The community suggests the creator wanted to demonstrate the resilience of Bitcoin addresses to brute-forcing keys. Participants treat cracking the puzzles as a bounty challenge rather than theft.

The anonymous creator tries to keep the community engaged. In April 2022 he increased rewards tenfold and withdrew bitcoins from every fifth address.

At the time of publication, 75 puzzles remain unsolved (nos. 66 to 160) with balances from 6.6 BTC (~$200,500) to 16 BTC (~$486,100). In total they hold 969 BTC (~$29.4m).

How do you claim bitcoins from the puzzles?

To solve a Bitcoin puzzle you must find the private key to the corresponding address.

Within the first 24 hours after the puzzle was created, users solved 29 of them. Cracking address no. 40 took two weeks, no. 47 seven months, and no. 64 five years.

The easiest remaining puzzle contains 66 random bits. The number of possible combinations is 7.37 * 10^19. If you check 1bn candidates per second on a GTX 1660 Ti GPU, sweeping the range would take two thousand years.

Community members have built dozens of tools for solving the puzzles. Here are a few:

• Private Key Finder — a web app for finding keys to Bitcoin and Ethereum wallets. Uses the computer’s CPU; no installation required;
• KeyHunt — open-source software for brute-forcing Bitcoin keys within a specified range. Uses the CPU; runs on Linux;
• BitCrack — another tool for brute-forcing private keys. Uses the GPU; runs on Windows.

To improve your odds, you can join the pool 66 Bit Collective. Participants split the search range for puzzle no. 66 into 33m parts and test them separately. If they succeed, the bounty is shared in proportion to the number of keys checked.

How do you create Bitcoin puzzles?

A similar puzzle can be created on any network. To do so, replicate the 2015 approach:

1. Generate 256-bit strings in which between 1 and 256 bits are random.
2. Turn each string into a private key using the cryptographic formula of the chosen blockchain.
3. Generate public addresses.
4. Fund them with tokens. Rewards should scale with the number of random bits in the key.

Experience with the Bitcoin puzzles shows that brute-forcing keys with 60 or more random bits can take several years.

To keep the game engaging, use several addresses with few random bits and smaller rewards, rather than adding coins for each additional bit.