Words the rest of the site assumes

Puzzle index. Address N is restricted to keys in the closed interval [2^N−1, 2^N - 1]. Key count is exactly 2^N−1. #71 has 2⁷⁰ candidates. #160 has 2¹⁵⁹. Each increment of N doubles the interval. Since 2023-04-16 the catalog unit is N times 0.1 BTC; that is nominal, not a live wallet.

In this catalog, bits equals N: the bit-length of scalars in the interval (the largest key is 2^N - 1). Search bits equals N-1: the binary length of the interval width 2^N−1. Saying a puzzle is 71-bit and saying it has 2⁷⁰ candidates are both correct; they name different quantities. The calculators use search bits for work.

A w-bit slice of a kangaroo search. It is not the full puzzle range. A window of w bits covers 2^w keys inside the 2^N−1 interval. Finishing the work budget of one window does not prove the key is absent from the puzzle. It only says that window was hunted under the algorithm and the chosen distinguished-point parameters.

Probability that a random key in the puzzle range sits inside a chosen w-bit window: 2^{w − (N−1)}, clamped to 0 or 1 at the edges. For #140 (interval 2¹³⁹) and w=96: 2⁹⁶⁻¹³⁹ = 2⁻⁴³ = 1 in 8,796,093,022,208, about 1 in 8.80 times 10¹². That is why a 96-bit kangaroo on #140 is not an inventory of the puzzle. Containment is not the probability that a finished search finds the key.

The elliptic curve used by Bitcoin. Puzzle private keys are integers k; the public key is the point P = kG. Address-only search never sees P. Kangaroo and BSGS need P and a bounded interval for k.

Pay-to-Public-Key-Hash. Legacy address starting with 1. All 160 catalog addresses are P2PKH. The locking script stores HASH160 of the compressed public key, not the public key. A receive never publishes the public key. A legacy P2PKH spend publishes it in the scriptSig the first time any UTXO of that address moves. That is a publication channel, not the only one: an owner can publish P, sign a message, or spend the same scalar in another script while the P2PKH output stays unspent. Unsolved does not mean no public key.

RIPEMD160(SHA256(pubkey)). Twenty bytes. The payload of a P2PKH address. A HASH160 collision is not a shortcut to puzzle #71. The birthday bound on RIPEMD-160 is about 2⁸⁰; #71 is a 2⁷⁰ search for one specific preimage, which is a different problem.

A point on secp256k1. Compressed form is 33 bytes with prefix 02 or 03. Puzzle keys use compressed public keys. Knowing the public key plus a bounded range enables kangaroo or BSGS. Knowing only HASH160 does not. The integer N is not the public key.

Wallet Import Format. Base58 of the private key plus version and compressed flag. This atlas does not convert keys to WIF and does not accept WIF, seed phrases, or live private keys. Never paste a live WIF into a website. WIF is not a public key. Historical solved scalars already in the catalog, where shown, are public reference material and unsafe for wallets.

Unlocking script of a legacy P2PKH input: signature, then the public key. A public broadcast of a P2PKH spend therefore shows the public key before confirmation. On a low range, that can start a race. See Claim, and the on-chain cases #66 and #69.

Brute-force search for address-only puzzles. Each candidate scalar is turned into a compressed public key, hashed to HASH160, and compared with the address payload. If the unknown key is uniform in the interval, expected scans are half the interval: 2^N−2 HASH160 comparisons. Sequential exhaustive scan and uniform random sampling with replacement are different processes; the mean for without-replacement exhaustive search is half the list, the median is also near half, and with-replacement sampling has a different tail. SHA-256d mining ASICs do not do this work.

Bounded ECDLP. Needs the public key. Expected work is on the order of the square root of the interval (or of the window), in elliptic-curve group operations, not HASH160 comparisons. A common order-of-magnitude heuristic is 2 * sqrt(N) group operations for an interval of size N. Galbraith, Pollard and Ruprai (ePrint 2010/617) state that the van Oorschot–Wiener kangaroo average is (2+o(1))√N. RCKangaroo documents an implementation constant 1.15 times sqrt(range) for its SOTA path, with other constants (about 2.1 classic, 1.6 three-way) in the same README; those are program parameters, not a law of nature. Address-only puzzles such as #71 have no public key in this catalog; kangaroo does not apply until P is known.

Baby-step giant-step. Another bounded ECDLP. Also needs the public key. Same family as kangaroo: discrete log in an interval, given P = kG. Memory versus time tradeoff differs. Without P, neither algorithm has a target.

Planned kangaroo group operations for one window. Hitting that budget is not full enumeration of the puzzle. Finishing a budget means that window was hunted. The key may sit in another window. Containment remains 2^w−(N−1). Completing the budget also does not by itself prove the key was found even if it was inside: that depends on the walk actually colliding, which is probabilistic.

Kangaroo and BSGS count elliptic-curve additions and similar group operations. A HASH160 scanner counts candidate keys whose public keys were hashed and compared. Do not label both as Gkeys/s without saying which. Expected-value arithmetic is only as honest as that unit.

Exhaustive scan walks every remaining candidate once. Uniform random sampling draws candidates (with or without replacement) and does not guarantee coverage. Kangaroo and BSGS are probabilistic group algorithms on a known point P: expected work scales with the square root of the interval, and a given run can miss even a contained key. These three are not interchangeable synonyms for search.

Pushing a raw spend through the ordinary mempool. Reveals the public key before confirmation. On a low range, an observer who recovers the same private key can issue a conflicting spend at a higher fee. Confirmed spends on #66 and #69 are different UTXOs on those days, not two spends of one outpoint. The publication race is real; a confirmed double-spend of one outpoint is not shown. This page is not a claiming procedure. See Claim.

Coins actually sitting on an address. Not the catalog sum. This atlas reports N times 0.1 BTC as a catalog unit after the 2023-04-16 increase. #120, spent before that increase, had about 1.20001 BTC on the explorer, not 12. #125, spent after the increase, had about 12.50004706 BTC funded and spent. Always open an explorer; this atlas does not query live balances.