What is the Bitcoin Puzzle?
A cryptographic challenge created in January 2015 by an anonymous user. In April 2017, BitcoinTalk user "saatoshi_rising" claimed to be the creator. 160 Bitcoin addresses were funded with increasing amounts. Each address N is locked with a private key in the range 2^(N-1) to 2^N − 1. The challenge is to find the private key and sweep the funds.
How much BTC is still unclaimed?
Approximately 916 BTC across 78 unsolved puzzles (as of mid-2025). Rewards range from 7.1 BTC (puzzle 71) to 16 BTC (puzzle 160). The total original pool was ~1000 BTC after the 2023 10× increase.
Why are some puzzles harder than others?
Each puzzle N has a key space of 2^(N-1) keys. Puzzle 66 has ~3.7×10¹⁹ keys; puzzle 71 has ~1.2×10²¹. Every increment doubles the search space. Puzzle 160 has 2¹⁵⁹ keys — more than the estimated atoms in the solar system.
What does "public key known" mean and why does it matter?
When a Bitcoin address makes an outgoing transaction, its public key is revealed in the transaction signature. For puzzles 135, 140, 145, 150, 155, and 160, the creator made small outgoing transactions in 2019 specifically to reveal these public keys. (Puzzle 130 also had its public key revealed, but it was solved in September 2024.)
This matters because knowing the public key enables Pollard's kangaroo and Baby-step giant-step (BSGS) algorithms, which need only ~2^(N/2) operations instead of 2^N. For puzzle 135, that's the difference between 2¹³⁵ and ~2⁶⁷ operations — a reduction so massive it makes the puzzle potentially solvable.
Which puzzle should I try to solve?
It depends on your approach:
- Brute force (address-only): Puzzle 71 is the lowest unsolved address-only target. You scan 2⁷⁰ keys checking each against the known address hash.
- Kangaroo (public key known): Puzzle 135 is the primary target. With the public key known, kangaroo needs ~2⁶⁷ operations — feasible with coordinated GPU power over months.
For puzzles above 71 without known public keys, brute force is currently infeasible.
What hardware do I need?
GPUs are the primary tool. A single RTX 3070 can scan ~4-5 billion keys per second for address-only brute force. For kangaroo on known public keys, GPU coordination is essential.
ASICs are not suitable — they're optimized for SHA-256 mining, not for the elliptic curve operations needed here. CPUs are too slow for serious work but can be used for small ranges or as supplementary scanners.
Many solvers rent GPUs by the hour from cloud providers. An RTX 3070 at $0.07/hr can scan ~12 ranges of puzzle 71 in 3 days for about $5.
What tools are available for solving?
Popular open-source tools:
- Keyhunt (albertobsd) — CPU brute force and BSGS
- Keyhunt-cuda (Wandering Philosopher) — GPU brute force
- Kangaroo (JeanLucPons) — GPU kangaroo for known public keys
- Etayson Kangaroo — modified kangaroo for puzzles 130+
- BitCrack — GPU address-only scanner
- lotterypzl + PZL-Roo + PZL-Hunter — our coordinated search suite
See our tools page for details, or the BitcoinTalk cracking tools thread.
Is it profitable? Should I invest in GPU time?
Expected value is negative for almost all puzzles. For puzzle 135 with a 96-bit window, the probability per fully searched ticket is about 1 in 550 billion. Even at 5 billion keys/second, a single ticket takes weeks of GPU time.
The puzzle is best understood as a lottery — a form of honest, bounded participation. If you enjoy the technical challenge and have spare GPU capacity, it's a fascinating project. If you're looking to make money, the math says don't.
What happened to puzzle 66?
Puzzle 66 (6.6 BTC) was solved on September 12, 2024 by address "1Jvv4y." However, the finder broadcast the spending transaction to the public mempool. Within seconds, bots monitoring the mempool extracted the public key from the signature, derived the private key using kangaroo/BSGS, and broadcast a replacement transaction (RBF) with a higher fee.
"bc1qpk" captured 5.94 BTC; "15XVN6" grabbed the remaining 0.66 BTC. The original finder got nothing.
Who is saatoshi_rising?
Unknown. The BitcoinTalk account was registered on April 27, 2017, made exactly 1 post (claiming authorship), received 32 merit, and was last active on June 9, 2019. No identifying information was ever shared.
Theories range from Satoshi Nakamoto to a wealthy early adopter to an educational organization. No theory has been confirmed. See our Theories page for detailed analysis.
Can quantum computers solve these puzzles?
Not yet. A sufficiently powerful quantum computer running Shor's algorithm could break elliptic curve cryptography, but current quantum hardware is far too small. The largest number factored by a quantum computer is in the low 2-digit range; puzzle keys need 71+ bits.
Some theorize the high-numbered puzzles with known public keys serve as a "quantum canary" — if one is suddenly solved without brute force, it might indicate a quantum breakthrough. This is speculative.
Is lotterypzl a pool or a marketplace?
No. lotterypzl is a CLI and TUI for coordinating bounded, ledger-backed search windows. It is not a pool — there's no shared reward. It is not a marketplace — you cannot buy or sell tickets. Each user runs their own GPU sessions. The ledger ensures no two sessions search the same range, eliminating wasted compute.
If you find a key, the reward is 100% yours (assuming you claim it safely — see our How to Claim guide).