Bitcoin Puzzle #67 Analysis
The current unsolved frontier. Puzzle #67 is now the lowest-numbered unsolved Bitcoin puzzle — making it the most actively hunted target on the board. After Puzzle #66 fell in September 2023, every serious GPU cluster pivoted here. This is the complete breakdown: keyspace math, current approaches, why it's harder than #66, and what it will take to crack it.
What is Bitcoin Puzzle #67?
In January 2015, an anonymous creator broadcast a single Bitcoin transaction containing 160 outputs, each locked to a Bitcoin address whose private key was hidden in a progressively harder keyspace. The transaction became known as the Bitcoin Puzzle Transaction.
Each puzzle is numbered by its bit-length — Puzzle #67 means the private key is a 67-bit integer, somewhere in the range 2^66 to 2^67 - 1.
The Bitcoin address is publicly known. Anyone who finds the private key can claim the BTC locked inside.
Puzzle #67 is the lowest-numbered unsolved Bitcoin puzzle as of 2026. After #66 was cracked in September 2023, the entire puzzle-hunting community shifted focus here. Multiple GPU clusters are actively running distributed kangaroo searches. The prize has not moved — 6.7 BTC remains locked in the address.
The original transaction was later augmented — additional BTC was added to some puzzle addresses, raising the stakes. Puzzle #67 holds 6.7 BTC. At current Bitcoin prices, that represents a substantial prize that justifies serious compute investment.
| Field | Value |
|---|---|
| Puzzle number | #67 |
| Bit length | 67 bits |
| Private key range | 2^66 → 2^67 − 1 |
| Keyspace size | 2^67 ≈ 1.476 × 10^20 |
| Prize (current) | 6.7 BTC |
| Created | January 2015 |
| Status | 🔴 UNSOLVED |
| Predecessor solved | September 2023 (#66) |
| Best approach | Pollard's Kangaroo (distributed) |
The Numbers
The 67-bit keyspace contains exactly 267 = 147,573,952,589,676,412,928 possible private keys — about 147.6 quintillion. The key insight: this is exactly 2× larger than Puzzle #66. That extra bit doubles the search space, doubles the expected kangaroo steps, and doubles the coordinated compute required.
- 2× larger than Puzzle #66 (66-bit, solved September 2023)
- 4× larger than Puzzle #65 (65-bit, solved)
- 2,147,483,648× smaller than Puzzle #98 (far future territory)
Brute force vs. kangaroo at various hardware speeds:
| Speed | Keys/sec | Expected time (full brute force) | With Kangaroo O(√n) |
|---|---|---|---|
| Consumer CPU | ~1M/s | ~4.7 billion years | ~3.4 hours |
| Consumer GPU | ~1B/s | ~4,674 years | ~12 seconds |
| GPU cluster (1K GPUs) | ~1T/s | ~1.7 hours | ~12ms |
| Network (distributed) | ~10T/s | ~10 minutes | sub-ms |
Every additional bit doubles the keyspace and adds ~1.41× more kangaroo steps (since kangaroo is O(√n), one more bit = √2 more work). Puzzle #67 requires ~12.1 billion kangaroo steps vs. #66's ~8.6 billion. The compute gap is real but not prohibitive — the same GPU clusters that cracked #66 could crack #67 with ~40% more runtime.
Keyspace compared to neighbors
Known Attempts
Puzzle #67 has been under active attack since late 2023. The puzzle-hunting community pivoted immediately after #66 was solved.
Distributed Kangaroo Projects
Multiple open-source implementations of Pollard's kangaroo — including JeanLucPons' Kangaroo and WanderingPhilosopher's kang — have been deployed against Puzzle #67. These tools coordinate via distinguished point collection: each GPU walker generates random points and reports "distinguished" ones (matching a set bit pattern) to a central server. When tame and wild walkers collide, the private key is recovered.
Solo GPU Hunters
Individual researchers with high-end GPUs (RTX 3090, 4090, A100-class hardware) run continuous kangaroo searches. Community forums like the Bitcoin Talk Puzzle Forum track kangaroo coverage and estimated percentages of the keyspace explored — though exact figures are unreliable given competing teams don't coordinate ranges.
Why It's Still Unsolved
Kangaroo's expected solve time is probabilistic — there's no guarantee of finding the key at exactly √n steps. The expected time is √n steps, but the distribution has a long tail. Additionally, coordination is the hard problem: multiple teams searching the same subranges waste compute, while a single coordinated cluster could crack it in milliseconds at sufficient hash rate.
Puzzle #67 is not unsolved because the algorithms don't work — they proved themselves on #66. It's unsolved because no single team has yet assembled enough coordinated compute and gotten lucky on the kangaroo collision. The longer it stays unsolved, the more compute accumulates against it.
Attack Vectors
Several algorithms apply to Bitcoin puzzles. Not all are equally viable at 67-bit difficulty. For a full breakdown of all 13 algorithms in the Intelligence Engine, see the Intelligence page.
Pollard's Kangaroo
Range-bounded ECDLP solver. Complexity O(√n). Requires ~2^33.5 ≈ 12.1 billion operations for a 67-bit problem. Parallelizable across GPUs with zero shared state. Distinguished points allow global coordination without a shared memory pool.
Best for #67 — Use thisBaby-step Giant-step (BSGS)
Deterministic O(√n) time, O(√n) space. For 67 bits: ~390 GB of storage required at 32 bytes per point. Feasible only with very large RAM (multi-terabyte pools). Faster per step than kangaroo but memory wall blocks most teams.
Memory-bound — ~390 GBPollard's Rho
General ECDLP solver using Floyd's cycle detection. Not range-bounded — doesn't exploit the known key interval. Less efficient than kangaroo for bounded problems. Used in academic settings but suboptimal for Bitcoin puzzles specifically.
Suboptimal for bounded searchBrute Force
Sequential key scan from 2^66 to 2^67. Full coverage but requires 147.6 quintillion operations. Even at 1 TKey/s this takes 1.7 hours for the full range — theoretically possible for a large cluster but far less efficient than kangaroo.
Not practical soloWhy kangaroo is the clear winner: Puzzle #67 has a known private key range (2^66 to 2^67-1). Kangaroo is designed precisely for bounded ECDLP — it finds the key in expected √n steps with O(1) memory per walker. At 67 bits, kangaroo requires only ~40% more work than #66. Every serious team is running kangaroo.
Explore all algorithms with technical detail, complexity analysis, and implementation notes at Lab Intelligence Engine →
Our Solvability Rating
The Lab Rankings page assigns a solvability score to each of the 160 puzzles, based on bit length, keyspace, estimated compute required, and community activity. Puzzle #67 rates as high solvability — the same tier as #66 before it was cracked.
The solvability model weights three factors:
- Effective compute — expected kangaroo operations at √n complexity: ~12.1 billion steps
- Memory requirements — kangaroo needs O(1) memory per walker; BSGS needs ~390 GB
- Community parallelism — high; multiple open-source tools exist, distinguished points enable global coordination
Puzzle #67 scores slightly lower than #66 did (since #67 has never been solved), but the compute gap is small. The main wildcard is coordination: the first team to pool enough GPU-hours in a single directed kangaroo run wins the prize. See the full rankings table to compare all 160 puzzles by solvability score.
Live Data
The Lab's Scan Machine monitors all 160 Bitcoin puzzle addresses in real time, tracking balances and detecting changes. Below is the live status for Puzzle #67. A balance change means someone found the key.
Data from the Lab's blockchain scanner. The Scan Machine checks puzzle addresses every few minutes. A non-zero to zero balance change means the puzzle was solved and the BTC was swept. View the full scan log at ⚡ Scan Machine →
For the full puzzle detail page with clues, research notes, and scan history, see Puzzle #67 detail →
Try Solving It
Puzzle #67 is live and unclaimed — 6.7 BTC locked in the address right now. The Lab Solver runs five algorithms in your browser using WASM-accelerated elliptic curve operations: Pollard's kangaroo, Pollard's Rho, BSGS, Meet-in-the-Middle, and BSGS Nonce Difference.
The browser-based solver won't beat a dedicated GPU cluster — but it's the fastest way to understand the algorithms, tune parameters, and contribute to the community's understanding of the keyspace. Load Puzzle #67 directly in the solver to start exploring.
Run the Solver on Puzzle #67
WASM-accelerated. Browser-based, no install. The current best target — 6.7 BTC unclaimed.