What is the Bitcoin Puzzle?

A Bitcoin private key is just a number between 1 and about 2²⁵⁶. The address is derived from that number through one way math: easy to compute forward, impossible to reverse. Normally, guessing a key is hopeless because the range is so vast that all the computing power on Earth would not make a dent in it.

The puzzle changes exactly one variable: the size of the range. Puzzle 1 hides its key between 1 and 2. Puzzle 2 between 2 and 4. Every step doubles the range, up to puzzle 160, whose key sits somewhere among 2¹⁵⁹ possible values. Each address was funded with real Bitcoin, roughly proportional to its difficulty, so the harder the puzzle, the bigger the prize.

That single constraint turns an impossible problem into a measurable one. The small puzzles fall in seconds. The middle ones take GPU farms months. And the big ones remain untouchable, which is precisely the point: the series maps, in public and with real money at stake, the exact frontier of what brute force can reach.

2015. The original transaction funds the puzzle addresses with small amounts that grow with the puzzle number. Nobody knows who sent it. The community notices that address N always holds a key that is exactly N bits long, and the hunt begins.

2017. The creator resurfaces to consolidate the untouched upper addresses and confirms the design in a short message: there is no pattern and no hidden meaning. The keys came from a random number generator. The puzzle is purely a measure of raw search power.

2019.The prizes on unsolved puzzles are raised roughly tenfold. In the same move, the creator sends tiny outgoing transactions from a set of high puzzles, deliberately exposing their public keys. That opens a second line of attack, Pollard's kangaroo algorithm, which needs only about the square root of the range once the public key is known.

2023. The prizes are raised again, bringing the total to about 1000 BTC. Since then the puzzles have kept falling one by one: the brute force frontier has passed 70 bits, and kangaroo solvers have cleared exposed key puzzles up to 130 bits.

You can follow the current state on the solved puzzles and unsolved puzzles pages, or see how much BTC is still unclaimed.

The puzzle is the best public calibration of Bitcoin's security that exists. Every solved puzzle marks how far real hardware has actually reached, not in theory but with a paid out prize as proof. And the gap between the frontier and a real wallet is enormous: even puzzle 160, the hardest in the series, is about 10²⁹ times easier than a standard 256 bit key. Brute forcing a normal Bitcoin wallet remains astronomically infeasible, which is worth remembering whenever the remaining $60,843,870 prize makes headlines.

The series has also become something more: a canary in the coal mine for quantum computing. Several unsolved puzzles have exposed public keys, which makes them breakable by Shor's algorithm the moment a capable quantum computer exists. Because these coins are unclaimed bounties rather than someone's savings, they are the most obvious and ethical first target. If they all fall within a short window, the world will know quantum attacks on Bitcoin have arrived. Read the full argument on the quantum canary page.