Frequently asked questions

The Bitcoin puzzle is a set of 160 Bitcoin addresses funded in January 2015 by an anonymous creator. Each address has a private key deliberately confined to a known range: puzzle #n has a key somewhere between 2^(n−1) and 2^n−1. Puzzle #1 has 1 possible key, #10 has 512, #71 has about 1.18 × 10^21. The creator later explained on Bitcointalk that it was intended as a simple, public benchmark for the state of the art in private key search — not a riddle with a hidden clue. There is nothing to decode. The only way in is to search the range.

Yes. The addresses hold real bitcoin, currently around 903 BTC across the 78 unsolved puzzles, and the coins are spendable by anyone who derives the private key. That is the entire design. Every solved puzzle so far has been swept within minutes of being cracked, usually by bots watching the mempool. If you do solve one, expect to compete with those bots on transaction fees.

It can — the mathematics is identical to what dedicated software does — but the probability on a consumer machine is vanishingly small for any unsolved puzzle. A fast eight-core laptop running this solver reaches roughly four million keys per second. Puzzle #71 contains 1.18 × 10^21 keys, so an exhaustive sweep would take about 9.4 million years. This solver is genuinely correct and genuinely fast for JavaScript; it is still nine or ten orders of magnitude short of what solving #71 requires. Treat it as an instrument for understanding the problem, not a plan for acquiring bitcoin.

For puzzle #71, searching at 4 million keys per second for one full year covers about 1.26 × 10^14 keys — roughly one ten-millionth of one percent of the range. That is your annual probability of success: about 1 in 9.4 million. Buying a lottery ticket has better expected value per unit of effort. The odds improve dramatically for smaller ranges, but every puzzle small enough to be within reach of a browser was solved years ago.

Seventy-eight remain: #71 through #74, #76 through #79, #81 through #84, and so on — every puzzle above 70 except the multiples of five up to 130, which have been solved. Puzzles 1 through 70 are all solved. The smallest unsolved puzzle is #71, holding 7.10 BTC; the largest is #160, holding 16.0 BTC.

Deriving a private key for these specific addresses is not hacking anything. The creator placed the funds intentionally and publicly stated they are there to be claimed by whoever solves the puzzle. That said, this is general information, not legal advice, and the tax treatment of a windfall like this varies enormously by country. If you ever do find a key, talk to a professional before you move the coins.

The creator returned in 2017 and again in 2023 to top up the unsolved addresses, multiplying the rewards several times over. Some addresses also receive tiny dust payments from people probing them. The balances shown on this site come from a verified snapshot; for a live figure, follow the block explorer link on any puzzle page.

A legacy Bitcoin address is just RIPEMD-160(SHA-256(public key)) — twenty bytes — wrapped in base58 with a checksum and a version byte. Those twenty bytes are the HASH160. Comparing raw HASH160 bytes skips base58 encoding entirely, which would otherwise cost more than the hashing itself. The solver decodes the target address to its HASH160 once at startup, then compares twenty bytes per candidate key.

GPU tools, not browsers. BitCrack and VanitySearch brute-force ranges on CUDA and OpenCL; keyhunt runs several search modes on CPU; Pollard's Kangaroo implementations are the fastest option when the public key is already known, reducing the work from O(N) to roughly O(√N). The recent large puzzles were solved by pooled GPU clusters, not individuals. Note that Kangaroo only helps once an address has spent a transaction and revealed its public key — for untouched puzzle addresses, only the public key hash is known, so brute force is the only option.

Because each puzzle doubles the range. #71 spans 2^70 to 2^71−1, and #72 spans 2^71 to 2^72−1 — exactly twice as many candidate keys. Ten puzzles higher is roughly a thousand times harder; twenty is a million times. This is also why the reward schedule rises so slowly relative to difficulty: the money grows linearly while the work grows exponentially.

Not in expectation. Sweeping a range in order and sampling it at random have the same expected number of trials before a hit. Random search matters for a different reason: if many independent people search the same puzzle from the start of the range, they all duplicate each other's work. Random starting points make that collision unlikely, so a crowd searching randomly covers far more distinct ground than a crowd searching sequentially. That is why random is this solver's default.

A sufficiently large fault-tolerant quantum computer running Shor's algorithm would break secp256k1 outright, making the puzzle ranges irrelevant. No such machine exists, and estimates for one capable of attacking 256-bit elliptic curve keys run to millions of physical qubits. Grover's algorithm would offer only a square-root speed-up on the brute-force search — reducing #71 from 2^70 to about 2^35 operations — but it needs a coherent quantum computer running for the whole search, which is far beyond current hardware.

No. The solver is plain JavaScript running in Web Workers inside your tab. There is no analytics, no cookies, no accounts, no network request of any kind after the page loads. You can verify this by opening your browser's network panel and watching it stay empty while the solver runs, or by saving the page and running it offline. If you find a key, it is displayed in your tab and stored nowhere else — copy it immediately.

No. Open a puzzle page, choose your thread count, and press start. The solver needs only a browser with Web Worker and BigInt support, which means any version of Chrome, Firefox, Safari or Edge from 2020 onwards. It works offline once loaded, and it works on phones, though a phone is roughly twenty times slower than a desktop and will get hot.