Plan ₿ Forum 2026 · Lugano · Oct 23–24
21 BTC

The Bitcoin puzzle transaction: why keys can't be guessed

What the famous puzzle addresses are, why small puzzles fall and big ones stay unsolved, and what it tells you about key security.

Share this page

What the puzzle is

In January 2015 someone sent coins to a long series of addresses whose private keys were chosen on purpose from tiny ranges: puzzle number N has a key somewhere between 2^(N-1) and 2^N. Anyone who finds a key can move the coins. It became the most-viewed thread in Bitcoin Discussion.

Why each step is twice as hard

Every next puzzle doubles the search range. The first few dozen were solved quickly with ordinary computers; later ones need huge GPU farms and clever algorithms such as Pollard's kangaroo, which only work when the public key is known. Each extra bit doubles the work.

What it means for your wallet

A real wallet key is a random number in a range of about 2^256, not 2^70. The puzzle shows how fast difficulty explodes: even the best-funded searchers stall far below 256 bits. Your risk is not guessing, it is a weak random generator, a leaked seed phrase or a scam.

How long brute force takes

Average search of half the 2^N range at 10^12 keys per second (a very generous assumption for a GPU farm). An order-of-magnitude illustration.

BitsTime
400.5 s
64107 d
713.7e+1 years
1002.0e+10 years
1285.4e+18 years
256 (a real wallet)1.8e+57 years

FAQ

Can I solve a puzzle on my laptop?
Not the unsolved ones. They need search spaces that take large GPU clusters a very long time. Beware of paid 'puzzle solver' software: much of it is malware.
Does the puzzle prove Bitcoin can be hacked?
No. The keys were made weak on purpose. Properly generated keys come from a range so large that guessing is not realistic.

On the site

Original bitcointalk.org threads

Our own explanation; forum threads are linked, not copied. Not investment advice.

More topics