Challenges
Worked exercises
Worked exercises on ranges, method class, containment versus success, and catalog unit. Each item is a question; open the disclosure for the hint and the worked answer.
Ranges and bits
Inclusive integer intervals. Big integers, not floating-point endpoints.
How many candidate keys does puzzle #71 have?
Count the scalars in [270, 271 − 1] as integers before opening the disclosure.
Hint and answer
Hint. The range of N is the closed interval [2N−1, 2N - 1]. Count inclusive width with integers.
Answer. From 270 to 271 - 1 there are exactly 270 scalars. 271 is the first integer outside the interval. 269 is expected exhaustive HASH160 comparisons under uniformity, not the key count. 71 factorial is unrelated.
If bits equals N and search bits equals N-1, what is search bits for #140?
Name the interval width of #140 in search bits, not scalar bits.
Hint and answer
Hint. Search bits names the binary length of the interval width 2N−1.
Answer. 139. #140 scalars are 140-bit at the top of the range; there are 2139 of them. Mixing the two names is how people write a calculator that is off by a factor of two.
You finish a 96-bit kangaroo budget on #140. Have you searched the puzzle?
Decide what a finished 96-bit kangaroo budget proves about #140.
Hint and answer
Hint. A window covers 2w keys inside 2N−1.
Answer. No. You hunted one 296 slice of a 2139 interval. Finishing the budget is not full enumeration, and it is not even a proof that a contained key was found. See containment next.
Which work, which unit
HASH160 comparison versus group operations. Containment versus success.
Given a known compressed public key for #140, which method applies?
Pick the method class that actually uses the known public key.
Hint and answer
Hint. In 2019 a 1,000-sat spend revealed public keys on the every-fifth series from #65. Kangaroo and BSGS need P.
Answer. Bounded ECDLP — kangaroo or BSGS — on interval [2139, 2140 - 1]. A HASH160 scanner still works but ignores the square-root reduction. A SHA-256d mining ASIC does neither. Without P, kangaroo has no target; #71 in this catalog is that case.
A 96-bit window on #140. Probability the uniform random key sits inside?
Compute the containment odds of a 96-bit window on #140.
Hint and answer
Hint. P = 2w − (N−1). N-1 = 139.
Answer. 296−139 = 2−43 = 1 in 8,796,093,022,208, about 1 in 8.80 times 1012. Finishing the kangaroo does not change that containment. 1/96 and 2−96 are different questions. Almost 1 if you finish the budget is the containment-versus-success mix-up.
If containment is 2−43, and one window run completes, is the find probability 2−43?
Separate the geometry of containment from the algorithm event of success.
Hint and answer
Hint. Completing a budget assumes the walk actually recovers a contained key.
Answer. Only if you also assume the probabilistic search succeeds whenever the key is inside. Containment is geometry of the interval. Success is an algorithm event. An honest expected-value line states both. Independent repeated windows compound as 1-(1-p)^sessions only under those assumptions.
A kangaroo planner and a HASH160 scanner both print a rate. Same unit?
Check whether the two printed rates share a unit before comparing them.
Hint and answer
Hint. Group operations versus keys hashed.
Answer. No. Kangaroo rates count elliptic-curve group operations. Address scanners count candidate keys hashed to HASH160. Mixing them in one Gkeys field makes expected value fiction. Write the unit on the field.
Uniform key in a fresh interval of width 270. Expected exhaustive trials?
Give the mean trial count for a sequential scan of a fresh 270 interval.
Hint and answer
Hint. Sequential without-replacement scan of a list.
Answer. Half the interval, 269. That is the mean (and near the median). Random with replacement is a different process and does not have a finite completion time. Kangaroo expected work is not this number.
Does an Antminer hunt these puzzles?
Decide whether SHA-256d mining hardware searches secp256k1 keys.
Hint and answer
Hint. Bitcoin mining is SHA-256d. Puzzle search is secp256k1 scalar work, then either HASH160 or ECDLP.
Answer. No. Mining ASICs compute SHA-256d. They do not run kangaroo and they do not scan secp256k1 address candidates. Installing a GPU toolkit on an ASIC does not appear as a setting. CUDA is irrelevant to that hardware.
Catalog unit and the 2019 leak
Nominal reward is not the UTXO. Twenty series addresses are not twenty-one outputs.
After the 2023-04-16 increase, the nominal reward of #N is?
State the post-increase catalog unit for #N, and the case where it does not apply.
Hint and answer
Hint. 872.19 BTC sent toward puzzle addresses in that transaction.
Answer. N times 0.1 BTC as a catalog unit. #71 prints 7.1, #160 prints 16. That is not the live balance. #120, spent before the increase, showed about 1.20001 BTC on the explorer, not 12. Always open an explorer; this atlas does not quote a spot price or a live UTXO.
What made kangaroo practical on the later every-fifth addresses?
Name the 2019 event that published the series public keys, with both dates.
Hint and answer
Hint. P2PKH reveals the public key in the scriptSig when spent. A receive does not.
Answer. The 1 June 2019 21-input spend published compressed public keys. Deposits were 16 May 2019. Catalog series: twenty addresses, #65 to #160 step 5. The deposit also paid #1; the spend also consumed 1PvaqLqRAivje7CactLR55xQBYvBeaDrXN. That publication is how this catalog learned those keys, not the only possible channel. #135 was spent 2026-07-28; remaining public-key targets at the 2026-09-11 chain spot-check: 140, 145, 150, 155, 160.
If a puzzle is unsolved, is the public key unknown?
Test the converse: does unsolved imply an unknown public key?
Hint and answer
Hint. Partial spends exist. Publication is not only a P2PKH scriptSig.
Answer. No. Unsolved does not mean no public key. The 2019 leak left several series addresses unsolved with P in the open. An owner can also publish P without spending. Spent does not mean balance zero. Do not write pubkey available if and only if spent.
What is not a method
Early scalars and folklore shortcuts.
The first four keys are 1, 3, 7, 8. Does that give #71?
Decide whether the keys 1, 3, 7, 8 constrain #71 in any way.
Hint and answer
Hint. saatoshi_rising wrote that there is no pattern.
Answer. No. Binary 1, 11, 111, then 1000. The all-ones run ends at #3. Finding #1 does not give #71. Treat those four as already-public historical scalars, not as a generator.