Bitcoin Puzzle #66 Analysis
The most-searched Bitcoin puzzle. Puzzle #66 sits at a notorious threshold — hard enough to require real compute, accessible enough that researchers actually attempt it. This is a complete breakdown of the keyspace, known attempts, best algorithms, and current status.
What is Bitcoin Puzzle #66?
In January 2015, an anonymous creator broadcast a single Bitcoin transaction containing 160 outputs, each locked to a Bitcoin address whose private key was hidden in a progressively harder keyspace. The transaction became known as the Bitcoin Puzzle Transaction.
Each puzzle is numbered by its bit-length — Puzzle #66 means the private key is a 66-bit integer, somewhere in the range 2^65 to 2^66 - 1.
The Bitcoin address is publicly known. Anyone who finds the private key can claim the BTC locked inside.
Puzzle #66 was solved in September 2023. It was one of the most active targets in the Bitcoin puzzle hunting community — the jump from 65-bit to 66-bit represents a 2× increase in keyspace, and multiple GPU clusters competed to crack it. The private key was found using a distributed implementation of Pollard's kangaroo algorithm.
The original transaction was later augmented — additional BTC was sent to some addresses, increasing the prize values. Puzzle #66 held 6.6 BTC when it was solved. With Bitcoin at present prices, that represented hundreds of thousands of dollars in prize value.
| Field | Value |
|---|---|
| Puzzle number | #66 |
| Bit length | 66 bits |
| Private key range | 2^65 → 2^66 − 1 |
| Keyspace size | 2^66 ≈ 7.38 × 10^19 |
| Prize (at solve) | 6.6 BTC |
| Created | January 2015 |
| Status | ✓ SOLVED |
| Solved | September 2023 |
| Method used | Pollard's Kangaroo (distributed) |
The Numbers
The 66-bit keyspace contains exactly 266 = 73,786,976,294,838,206,464 possible private keys — about 73.8 quintillion. To put that in perspective:
- 4× larger than Puzzle #65 (64-bit)
- 16× larger than Puzzle #63 (62-bit, solved 2022)
- 4,294,967,296× smaller than Puzzle #98 (still unsolved)
Brute force at various speeds:
| Speed | Keys/sec | Expected time (full scan) | With Kangaroo (O(√n)) |
|---|---|---|---|
| Consumer CPU | ~1M/s | ~2.3 billion years | ~2.3 hours |
| Consumer GPU | ~1B/s | ~2,331 years | ~8.6 seconds |
| GPU cluster (1K GPUs) | ~1T/s | ~0.43 days | ~8.6ms |
| Network (distributed) | ~10T/s | ~2.1 hours | sub-ms |
Brute force is not the right approach. The kangaroo algorithm reduces 2^66 operations to approximately 2^33 ≈ 8.6 billion operations — a √n improvement. This is the approach that cracked Puzzle #66 in practice.
Keyspace compared to neighbors
Known Attempts
Puzzle #66 attracted some of the most sophisticated distributed computing efforts in the Bitcoin puzzle hunting community before it was solved.
Large Bitcoin Collider (LBC)
The Large Bitcoin Collider was a distributed project that searched for private keys across many Bitcoin addresses. It contributed compute to Puzzle #66 alongside its broader address scanning, but the approach was not optimized for range-bounded searches — making it less efficient than kangaroo implementations for this specific target.
GPU Clusters and Solo Hunters
Multiple researchers ran custom CUDA/OpenCL implementations of Pollard's kangaroo algorithm on GPU clusters. The competitive nature of the prize meant many teams worked in parallel, each searching different subranges and pooling distinguished points. The BitcoinWhosWho and Puzzle Forum communities actively tracked progress, with hunters reporting kangaroo step counts and estimated coverage.
BSGS Attempts
Baby-step Giant-step (BSGS) was also attempted. For a 66-bit problem, BSGS requires storing approximately 2^33 ≈ 8.6 billion points — about 275 GB of memory at 32 bytes per point. This memory requirement made it impractical for most solo researchers, but some teams with large RAM pools attempted it.
The Winning Solve
Puzzle #66 was solved in September 2023. The private key was claimed, the 6.6 BTC was swept from the address, and the solve was confirmed on-chain. The solver did not publicly disclose their exact setup, but community analysis suggests a distributed kangaroo implementation across multiple GPU machines, likely with aggregated distinguished points.
The techniques that cracked #66 apply directly to Puzzle #67 — just with a 2× larger search space. The key question is not whether the algorithm works, but who has enough coordinated compute to run it first.
Attack Vectors
Several algorithms apply to Bitcoin puzzles. Not all are equally viable at 66-bit difficulty. For a full breakdown of all 13 algorithms in the Intelligence Engine, see the Intelligence page.
Pollard's Kangaroo
Range-bounded ECDLP solver. Complexity O(√n). Requires ~2^33 operations for a 66-bit problem. Parallelizable across GPUs. Distinguished points allow distributed coordination without shared state.
Best for #66–#75Baby-step Giant-step (BSGS)
Deterministic O(√n) time, O(√n) space. For 66 bits: ~275 GB storage. Feasible only with large RAM. Faster per step than kangaroo but memory-bound for most teams.
Memory-boundPollard's Rho
General ECDLP solver, not range-bounded. Uses cycle detection. Less efficient than kangaroo for bounded problems because it doesn't exploit the known key range.
Suboptimal for puzzlesBrute Force
Sequential key scan from 2^65 to 2^66. Complete coverage but requires 73.8 quintillion operations. Even at 1 TKey/s, this takes 0.43 days for the full range — only viable as a partial coverage sweep.
Not practicalWhy kangaroo wins: The Bitcoin puzzles have a critical property that makes kangaroo ideal — the private key is known to be in a specific range (2^65 to 2^66-1). Kangaroo is designed exactly for this: bounded ECDLP with a known interval. It finds the key in O(√n) expected time while using only O(1) memory per walker. Distributed kangaroo multiplies throughput linearly with walkers.
Explore all algorithms with technical detail, complexity analysis, and implementation notes at Lab Intelligence Engine →
Our Solvability Rating
The Lab Rankings page assigns a solvability score to each of the 160 puzzles, based on bit length, keyspace, estimated compute required, and community activity. Puzzle #66 was rated as high solvability — and the rating proved accurate.
The solvability model weights three factors:
- Effective compute — expected kangaroo operations at √n complexity
- Memory requirements — BSGS memory barrier vs. kangaroo's low memory
- Community parallelism — whether distributed coordination is practical
At 66 bits, all three factors were favorable: ~8.6 billion kangaroo steps, low memory overhead, and easy distributed coordination via distinguished points. See the full rankings table to compare all 160 puzzles by solvability score.
Live Data
The Lab's Scan Machine monitors all 160 Bitcoin puzzle addresses in real time, tracking balances and detecting changes. Below is the live status for Puzzle #66.
Data from the Lab's blockchain scanner. The Scan Machine checks puzzle addresses every few minutes. View the full scan log at ⚡ Scan Machine →
For the full puzzle detail page with clues, research notes, and scan history, see Puzzle #66 detail →
Try Solving It
Puzzle #66 is solved — but studying it teaches you the techniques that apply to all remaining unsolved puzzles (#67–#160). The Lab Solver runs five algorithms in your browser: Pollard's kangaroo, Pollard's Rho, BSGS, Meet-in-the-Middle, and BSGS Nonce Difference.
You can load Puzzle #67 (the new lowest unsolved puzzle) or any other target directly in the solver. The WASM-accelerated engine runs at up to 27× faster than pure JavaScript.
Run the Solver Now
Browser-based, no install. Try the algorithms that cracked #66 against #67 and beyond.