On July 28, 2026 the 13.5 BTC sitting at 16RGFo6hjq9ym6Pj7N5H7L1NR1rVPJyw2v moved out in one clean transaction, block 959946. The solver goes by RetiredCoder, and the search behind it ran for about five months across 200 GPUs using his own RCKangaroo implementation. He has since announced that he is done with the puzzle for good, and that he is releasing the complete sources for the assembly kernels that got him there.
That last part matters more than the prize. Until now nobody could say what a Kangaroo search actually costs at this scale, only what the theory predicts. Five months and 200 GPUs is a measurement, and a measurement lets you price everything that is left.
Five months on 200 cards is about 83 GPU years of continuous work. Hold that number, because the rest of the ladder follows from it mechanically.
Kangaroo finishes in roughly the square root of the interval it is searching. Each puzzle doubles the interval, so each step of five puzzles multiplies the interval by 32 and the square root of that is about 5.66. Every rung up the exposed key ladder costs five and a half times the rung below it. Nothing else changes: same algorithm, same kernels, same cards.
| Puzzle | Prize | Kangaroo work | Scaled from 135 |
|---|---|---|---|
| 135 | 13.5 BTC | 2^67 | 83 GPU years, measured |
| 140 | 14 BTC | 2^69.5 | 470 GPU years |
| 145 | 14.5 BTC | 2^72 | 2,656 GPU years |
| 150 | 15 BTC | 2^74.5 | 15,025 GPU years |
| 155 | 15.5 BTC | 2^77 | 84,992 GPU years |
| 160 | 16 BTC | 2^79.5 | 480,787 GPU years |
Read that column honestly. Puzzle 140 is a real target: 470 GPU years is two and a half years for the same 200 card fleet, against a prize of $1,091,679at today's price. Puzzle 145 is five and a half times that work for half a bitcoin more. Everything above 145 is a research problem, not a project.
Puzzle 135 covers a range of 2^134 keys. Puzzle 71 covers 2^70, which is smaller by a factor of about eighteen quintillion. Puzzle 135 is now solved. Puzzle 71 is still sitting there with 7.10 BTC on it.
The difference is not effort or luck. Five of the puzzles still open have their public keys on chain, which means Kangaroo applies and the work drops to the square root of the range. The rest do not, which means the only method is walking the range key by key. On a fast card that is a little under two billion keys a second, so puzzle 71 comes out at roughly 20,000 GPU years.
Put the two next to each other and the ranking inverts: puzzle 140 needs about forty times less compute than puzzle 71 and pays roughly twice as much. If you own GPUs and you are choosing where to point them, that is the whole decision. The mechanics of why are on our Pollard's Kangaroo page.
Every time a puzzle falls, the same question comes back: do the solved keys sit anywhere in particular inside their ranges? If they clustered, you could search the good part first and skip the rest. So we checked, using the 82 solved keys we hold.
Normalise each key to its position in its own range and the answer is that they look exactly like random numbers. The Kolmogorov-Smirnov test against a uniform distribution returns p values of 0.37 for puzzles 20 and above, 0.88 for 40 and above, and 0.75 across all of them, which is as clean as this test gets. Splitting the positions into ten buckets gives a chi squared of 13.0 against a critical value of 16.9. Lag one autocorrelation between consecutive puzzles is minus 0.011. Across 3,633 free bits in the solved keys, 1,788 are ones, which is within one standard deviation of even.
With 82 samples you cannot prove perfect uniformity, and we are not claiming it. What you can rule out is any bias large enough to be worth acting on. To make a brute force puzzle tractable you would need the key to live in a thousandth of its range, and a skew that severe would have shown up in the very first test. Start wherever you like. It makes no difference.
It started on January 15, 2015, in block 339085. One transaction, 256 outputs, 32.896 BTC in total, handed out in a rising staircase: 0.001 BTC to the first address, 0.002 to the second, all the way to 0.256 at the end. Each address held a key drawn from a range one bit larger than the last, so the whole thing was a ladder with a rung for every difficulty a searcher might reach.
The first year took the bottom off it. Forty nine puzzles fell in 2015 alone, most of them small enough for a laptop. Then the easy rungs ran out and the pace collapsed to a few a year. The creator came back twice with more money, on July 11, 2017 and again on April 16, 2023, multiplying the prizes rather than adding new addresses. Puzzle 71 is a good measure of that: it began life holding 0.071 BTC and now sits on more than seven.
| Year | Solved | What was happening |
|---|---|---|
| 2015 | 49 | The shallow end, cleared in months |
| 2017 to 2018 | 9 | GPU search becomes worth the electricity |
| 2019 | 14 | The best year since the first, and not because the ranges got smaller |
| 2020 to 2023 | 5 | One or two a year, each one a project |
| 2024 to 2026 | 6 | 66, 130, 67, 68, 69, and now 135 |
Look at 2019 in that table. Fourteen puzzles in a single year, at sizes nobody was brute forcing. That is the year the ladder stopped being one ladder and became two, and everything since has followed the same split: the puzzles that can be attacked with Kangaroo keep falling, and the ones that cannot sit there collecting interest. Puzzle 71 has now been the cheapest unsolved brute force target for seven years running, and nobody has taken it.
The 13.5 BTC left the puzzle address in one transaction and landed where it was meant to land. That is worth noting, because it does not always go that way. Solving the key is only half the job. The moment you sign a spend, your public key and signature are visible to anyone watching the mempool, and there are bots whose entire purpose is to rebuild that transaction with a higher fee and take the coins.
It has happened on this challenge more than once. If you ever do win one of these, the transaction needs to reach a miner without passing through the public mempool first. Work that out before you start searching, not after.
RetiredCoder says he is releasing full sources for the assembly kernels behind RCKangaroo, and pointed everyone at puzzle 140 on his way out. Both halves of that are going to matter. Faster public kernels lower the cost for everyone, and a named next target concentrates attention.
Expect 140 to become crowded, and remember that this is winner takes all. Two and a half years of 200 cards is only worth it if you are the one who finishes, so the arithmetic that matters is not the cost of the search but the cost divided by your share of everyone else's. The private key for 135 has not been published yet; RetiredCoder said he will post it later. We will add it here and to the puzzle 135 page when he does.
Written September 10, 2026. Prize figures update live from the chain.