Every puzzle address comes with an exact private key range. Brute force walks that range one key at a time. Pollard's Kangaroo walks it in about the square root of the steps, but only when the public key is on the table. That single condition decides which puzzles are hard and which are merely expensive.
Recovering a private key from a public key is the elliptic curve discrete logarithm problem. In the open it is considered infeasible at 256 bits. The puzzle changes the game by promising that the key sits inside a small, known interval. Pollard's Kangaroo is built for exactly that case: a discrete log with known bounds. Its running time scales with the square root of the interval width, so a range of width W is solved in roughly 2 times the square root of W group operations, not W.
This is why the method is such a big deal for the harder puzzles. A 130 bit range holds about 2129 keys. Brute force will never finish. The kangaroo method cuts that to about 265 steps, which is a target that real distributed searches have been throwing hardware at.
The name comes from two sets of jumps across the number line of possible keys. A tame kangaroo starts from a known point and hops forward in pseudo random but repeatable steps, dropping a marker whenever it lands on a distinguished point. A wild kangaroo starts from the unknown target, the public key you are trying to break, and hops with the same rules.
Because both herds follow the same jump function, sooner or later a wild kangaroo lands where a tame one has already been. That collision ties the unknown key to a known distance, and the private key falls out by subtraction. Storing only the distinguished points keeps memory small, and the whole search parallelises cleanly across many machines, which is why pooled efforts use it.
The gap grows fast with the number of bits. Both columns count operations, so smaller is better.
| Puzzle | Brute force | Kangaroo |
|---|---|---|
| 80 bit | 279 | 240 |
| 100 bit | 299 | 250 |
| 120 bit | 2119 | 260 |
| 130 bit | 2129 | 265 |
The kangaroo method only helps on puzzles whose public key is already visible on chain, which happens once an address has spent an output. Right now 6 unsolved puzzles have an exposed public key, holding 88.5014 BTC (about $5,875,253) between them. Every other unsolved address hides its key behind a hash, so there brute force is still the only road.