Bitcoin Puzzle Guide
In 2015, someone sent Bitcoin to 160 addresses with private keys hidden in progressively harder keyspaces. Most are unsolved. Together they hold over 32 BTC. This is everything you need to know to understand — and attempt — them.
1. What Are Bitcoin Puzzles?
The Bitcoin Puzzle Transaction is a challenge created by an anonymous person on January 15, 2015. They funded 160 Bitcoin addresses, each holding an incrementing amount of BTC — puzzle #1 holds 0.001 BTC, puzzle #2 holds 0.002 BTC, and so on up to #160. The private keys to these addresses are not random: they were deliberately chosen from predictable, constrained keyspaces.
The challenge: find the private key for each address. The creator published the addresses publicly but never revealed the keys. Whoever finds a key can sweep the BTC immediately. There is no central authority, no deadline, and no official rules — just math.
The creator likely wanted to demonstrate the security properties of Bitcoin's cryptography — showing that even with constrained keyspaces, finding the right key gets exponentially harder as the bit length grows. It's become one of the most studied public cryptographic challenges in Bitcoin's history.
The puzzles have attracted cryptographers, hobbyist miners, GPU farmers, and academic researchers. Solving even a mid-range puzzle (60–70 bit) would require significant compute and a clever algorithm. Solving puzzle #160 would require breaking Bitcoin's elliptic curve cryptography itself — which is considered computationally infeasible with current technology.
2. How the Puzzles Work
Each puzzle has a bit length — the number of bits in the private key's keyspace. An N-bit puzzle has its private key somewhere in the range 2^(N-1) to 2^N - 1. Puzzle #1 has exactly 1 possible key. Puzzle #20 has ~1 million. Puzzle #66 has ~36 quadrillion.
Keyspace sizes at a glance
Each increment of 1 bit doubles the keyspace. Going from puzzle #66 to #67 means searching twice as many keys. This is why lower puzzles get solved but the unsolved ones above #66 remain intact — the compute required grows exponentially.
What makes a key "valid"?
A Bitcoin private key is a 256-bit integer. Using elliptic curve multiplication (secp256k1), you derive a public key. Hash the public key with SHA-256 then RIPEMD-160, encode it with Base58Check, and you get a Bitcoin address. If your computed address matches the puzzle's target address, you've found the key. There's no shortcut to verify without doing the math — each candidate must be hashed and compared.
3. Current State
As of 2026, puzzles #1 through #66 are solved. The first 20 were solved almost immediately after the transaction was published. Higher puzzles required progressively more sophisticated algorithms and compute. Puzzle #66 was solved relatively recently, using GPU-accelerated search with Pollard's kangaroo algorithm.
| Range | Puzzles | Status | BTC per puzzle (approx) | Notes |
|---|---|---|---|---|
| #1 – #20 | 20 | ✓ Solved | 0.001 – 0.020 | Trivial keyspaces |
| #21 – #40 | 20 | ✓ Solved | 0.021 – 0.040 | Solvable with basic compute |
| #41 – #60 | 20 | ✓ Solved | 0.041 – 0.060 | Required optimized algorithms |
| #61 – #66 | 6 | ✓ Solved | 0.061 – 0.066 | GPU + kangaroo required |
| #67 – #80 | 14 | Unsolved | 0.067 – 0.080 | Active research focus |
| #81 – #120 | 40 | Unsolved | 0.081 – 0.120 | Requires large distributed compute |
| #121 – #160 | 40 | Unsolved | 0.121 – 0.160 | Likely infeasible today |
Total BTC in unsolved puzzles (#67–#160): approximately 32+ BTC. See the live dashboard for current balances and real-time blockchain monitoring.
4. Approaches to Solving
There is no single algorithm that works for every puzzle. The right approach depends on the bit length. Here are the four main methods used by researchers and solvers:
Brute Force
Try every key in the keyspace sequentially. Works for small puzzles (<40-bit). Completely infeasible above 50-bit — even at 1 trillion keys/second, a 60-bit keyspace takes over 13 days.
≤ 40 bitBaby-step Giant-step (BSGS)
Precompute a table of "baby steps," then search for matches with "giant steps." Time-memory tradeoff — reduces search from O(N) to O(√N) at the cost of RAM. Effective up to ~50-bit.
≤ 50 bitPollard's Rho
A probabilistic algorithm that uses cycle detection to find collisions in the elliptic curve group. O(√N) time complexity with minimal memory. Good middle ground for moderate keyspaces.
40–65 bitPollard's Kangaroo
The gold standard for known-range ECDLP (elliptic curve discrete log). Uses two "kangaroos" that hop pseudorandomly until they collide — expected √(2·range) operations. GPU-parallelizable and currently the best tool for puzzle #67+.
65+ bitFor serious attempts at puzzles #67 and above, Pollard's kangaroo on GPU clusters is the current state of the art. Distributed implementations split the work across many machines. See Intelligence Engine for in-depth analysis of attack strategies, estimated compute requirements, and community research on each approach.
5. Solvability Rankings
Not all unsolved puzzles are equally interesting to the research community. BTC Puzzle Research Lab maintains a ranked list of all 160 puzzles scored by multiple signals:
- Clue count — how many public clues have been found about this puzzle's key
- Research activity — community notes, discussion volume, and cross-references
- Source quality — number of independent sources confirming information
- Proximity — how close the puzzle is to the current frontier (just above #66)
- Compute feasibility — estimated time with current best algorithms
Puzzle #67 consistently ranks highest: it's one step beyond the solved frontier, has the most accumulated research, and is the most likely to fall next. Puzzle #130 has surprisingly high clue accumulation relative to its difficulty — an outlier worth tracking.
6. Try It Yourself
The BTC Puzzle Solver runs entirely in your browser — no install, no signup required. It implements all four main algorithms with a WASM-accelerated core that runs at 779K+ ops/sec on modern hardware.
What the solver can do:
- Run Pollard's kangaroo, Rho, BSGS, and Meet-in-the-Middle directly in-browser
- Auto-select the best algorithm based on the target puzzle's bit length
- Save progress to IndexedDB — checkpoint survives browser reloads
- Sync discovered DPs (distinguished points) across multiple tabs/devices
- Automatically broadcast found keys to the Bitcoin network
The browser solver is excellent for learning and for genuine attempts at lower-bit puzzles. For puzzle #67 and above, GPU-scale compute is required. The solver is the right starting point — not the end of the road.
7. For Researchers
If you're doing serious research — running a distributed solver, writing a paper, or building tooling — BTC Puzzle Research Lab offers data access beyond what's visible in the UI:
- Bulk CSV/JSON exports — all 160 puzzles with addresses, bit lengths, statuses, clue counts, and rank scores
- Per-puzzle exports — deep dive on any single puzzle including all clues and notes
- API access — query puzzle data programmatically with an API key
- Solver finds archive — historical log of all keys discovered via the solver, with verification status and TX hashes (view finds)
Data access is part of the Premium tier ($9/month). API keys are SHA-256 hashed at rest and shown only once on generation. All exports stream directly from the live database.
8. FAQ
Is solving Bitcoin puzzles legal?
Yes. The puzzle creator intentionally placed BTC in publicly known addresses. Finding the private key to those addresses is the intended challenge — there is no hacking involved, no system intrusion, no unauthorized access. It's a cryptographic puzzle, not a heist.
How much BTC is left in the unsolved puzzles?
Approximately 32+ BTC is locked in unsolved puzzles (#67–#160). The exact total fluctuates slightly as the creator has occasionally added BTC to specific addresses. The live dashboard shows current balances refreshed via blockchain monitoring.
Has anyone solved a puzzle recently?
Yes. Lower-bit puzzles continue to be solved as compute improves. Puzzle #66 was the most recent milestone. All solved puzzle events are logged with timestamps, solving methods (where known), and transaction hashes on the puzzle dashboard.
Can I solve puzzles on a regular computer?
For puzzles below ~50-bit: yes, with the right algorithm. Our browser-based solver can handle these natively. For puzzle #67 and above, you need GPU compute — the keyspace is simply too large for consumer CPUs to search in any reasonable timeframe.
What's the best puzzle to target right now?
Puzzle #67 is the research community's consensus target: it's the next step beyond the solved frontier, has accumulated the most research, and is realistically attackable with GPU-scale kangaroo. If you don't have GPU infrastructure, puzzle #50 and below are approachable with the browser solver. See the Rankings page for the full picture.
Who created the Bitcoin puzzle transaction?
Unknown. The creator is anonymous. The transaction was published on January 15, 2015 to the Bitcoin blockchain. The creator has never publicly identified themselves, though there have been occasional on-chain messages. The puzzles stand as a pure cryptographic challenge regardless of the creator's identity.
Ready to start exploring?
The live dashboard tracks all 160 puzzles in real-time — balances, blockchain activity, clues, and community research.