Myths
Wrong ideas about solving them
Thirty-six claims that circulate as methods. They are not. Read this before you rent a GPU, paste a key, or treat a pool token as bitcoin.
How to read a myth
Each entry has three parts: the claim as it circulates, why it fails, and what to do instead. Claims are reproduced so they can be recognised, not endorsed. What is claimed lives on /theories/; failure modes are canonical here.
A claim is quoted from forums, chat channels, repositories or paid marketing. Quoting it is not a citation of a fact; it is a citation of a thing people say.
Two target classes decide which method is even applicable. An address-only record publishes HASH160(compressed P) and nothing else, so the only route is to hash candidate scalars — the work is linear in the interval. A record with a published public key publishes the point P, so a bounded discrete-log method applies: Pollard kangaroo or BSGS, whose work is exponential in half the width of the window you choose to search. Confusing the two classes is the most common error on this page.
Nothing here, and nothing on this site, asks for a private key, a WIF or a seed phrase. A page that asks for one is the subject of the first operations myth, not a tool.
What actually searches
The two genuine work items in the 2015 set, stated as target classes rather than as product names.
#71 — brute force
270 candidate scalars, no published public key. The only route is hashing keys inside [270, 271 − 1]: at the tens of billions of keys per second a small multi-GPU farm plausibly reaches, one full sweep is measured in centuries — roughly 935 years at 4×1010 keys/s. Every lower record is already spent, which is why #71 is first in line, and a lottery rather than an inventory.
#140 — kangaroo / BSGS
A 2139 interval whose compressed public key has been public since the 2019 leak of the every-fifth series. A 96-bit window inside it contains the key with probability 2−43 — about 1 in 8.80 trillion — so a bought window is a ticket, not a search of the puzzle. Group methods on a bounded interval are exponential in half the window width, never linear in the range.
Hardware & method
What actually searches secp256k1 keys, and what only looks busy.
An Antminer / mining ASIC will grind the puzzles.
Why it fails — Mining ASICs compute SHA-256d for proof of work. Puzzle search is secp256k1 scalar multiplication (and, with a public key, kangaroo/BSGS). The chip does not do that work. Instead — GPUs. An address-only record needs a scanner that tries candidate scalars and compares HASH160 — public implementations include BitCrack, Keyhunt and VanitySearch. A record with a published public key needs a bounded discrete-log solver (Pollard kangaroo or BSGS), for which RCKangaroo is a public implementation. Mining hardware does neither job.
NiceHash, ethash, or any GPU “miner” is the same as a key scanner.
Why it fails — Those programs hash a different function for a different market. Pointing them at a puzzle address does not walk 2N−1 … 2N − 1. Instead — A scanner that walks candidate scalars inside the published interval — or, when the public key is known, performs kangaroo jumps inside it. Nothing that hashes a mining header.
A phone, a laptop CPU, or a free Colab notebook is enough for #71.
Why it fails — #71 is a 270 interval: about 1.18×1021 candidate scalars. At tens of billions of keys per second — a plausible order of magnitude for a small multi-GPU address search — a single sweep of the interval takes centuries: the arithmetic gives roughly 935 years at 4×1010 keys/s, and even at 1012 keys/s it is decades. A phone, a laptop CPU or a free notebook session sits far below any such rate. Instead — Read expected value before you rent. If the number is negative and you wanted income, stop.
A GitHub repo that “solves the Bitcoin puzzle in minutes.”
Why it fails — Those repositories demo the first spent keys (1, 3, 7, …) or a random-key tester against the 160 addresses. They do not enumerate 270. Minutes is the runtime of the demo, not of #71. Instead — If a tool does not state the interval, the method it uses, and a measured keys/s on named hardware, it is not a solver.
A lucky website will roll the key if you keep clicking.
Why it fails — A browser tab sampling uniform 256-bit (or even 71-bit) keys is a lottery ticket with worse odds than a GPU walking a coordinated window. Many such sites also want a paste of a key you should never type into a page. Instead — Do not hunt in a browser form. The atlas is a map. The scanner is a GPU process you control.
Mixing random jumps with sequential scan is a cryptobreak.
Why it fails — Random and sequential are two ways to visit the same interval. They do not reduce its size. Without a public key they do not become kangaroo. Coverage still tracks how many distinct keys you hashed, not how clever the shuffle looked. Instead — Pick a method that matches the class — HASH160 brute force on an address-only record, kangaroo on a known public key — and count distinct keys tried. A shuffle is not a reduction.
Cryptography
What the math allows. Kangaroo needs a public key. HASH160 is not a shortcut.
Run kangaroo / BSGS on #71.
Why it fails — Pollard kangaroo and BSGS solve a bounded discrete log when you have the public key P and you search k in an interval with P = k·G. Address-only puzzles publish HASH160(compressed P), not P. Without P there is no kangaroo. Instead — #71 is an address-only record: brute force over HASH160. Kangaroo and BSGS apply to #140, #145, #150, #155 and #160, whose compressed public keys were published in the 2019 leak.
Recover the #71 public key by adding G until HASH160 matches, then kangaroo.
Why it fails — Walking P, P+G, P+2G, … and hashing each point is brute force of the interval, just written in the language of points. It is not cheaper than scanning scalars. Repos that advertise this as a “pubkey finder” are relabeling the hunt. Instead — Publishing a public key through a spend is one channel, not the only possible one. You also hold the point once you know the scalar, and a holder of a key can publish the point without spending. What an address-only record denies you is a starting point for a group method; it is not proof that no public key exists.
A quantum computer can take #140 this year.
Why it fails — Breaking secp256k1 with Shor’s algorithm needs a fault-tolerant machine that does not exist as a public fact today. A spend on a high kangaroo target would not, by itself, identify the method. See Theories for the canary story. Instead — Classical kangaroo on the known-pubkey set, or do not hunt. Do not budget for a machine you cannot rent.
Find any key whose HASH160 collides with the address. Easier than the range.
Why it fails — A second-preimage on HASH160 is ~2160 work. #71 is 270. #140 kangaroo, with a public key, is a bounded ECDLP, not a hash collision. You do not get to swap in the easier-sounding number. Instead — Walk the published interval. That is the whole point of a bounded key.
Bitcoin keys are 160-bit because of RIPEMD-160, so #71 is really 160 bits.
Why it fails — The address is HASH160 of the public key. The private key is still an integer in [270, 271 − 1] for puzzle 71. HASH160 does not enlarge that interval, and it does not shrink a normal 256-bit key down to 71 bits either. Instead — Read the hex range on the folio. That is the candidate set.
A rainbow table of Bitcoin keys already contains #71.
Why it fails — A table of all 270 71-bit keys is not a file you download. Tables that exist cover tiny prefixes, vanity, or brainwallets. They are the first spent puzzles, not the open ones. Instead — If someone is selling you a table of #71, they are selling you a story.
A BIP39 mnemonic will generate the puzzle keys.
Why it fails — BIP39 seeds ordinary HD wallets (m/44'/0'/0'…). The 2015 claimant described a deterministic wallet plus an N-bit mask, not a 12-word phrase from 2013. Guessing English words is another brute force, of a different space, with no published reduction to these addresses. Instead — Do not import “puzzle 71” as a recovery phrase. It will not be the key, and it trains a bad habit.
The passphrase is “puzzle 71” / “satoshi rising” / something in a talk.
Why it fails — These addresses are P2PKH of compressed secp256k1 points from bounded scalars, not SHA-256(passphrase). DEF CON brainwallet talks are a different object. See Theories → mix-ups. Instead — No passphrase hunt. Interval hunt.
An LLM can predict the next key.
Why it fails — Language models sample tokens. They do not invert HMAC or secp256k1. A plausible-looking hex string from a chat is a random guess with extra confidence. Spent keys in the prompt do not leak the seed. Instead — Use a model to read the atlas. Do not use it as a generator of live keys.
The private key is the puzzle number (or 2N − 1).
Why it fails — #1 = 1, #2 = 3, #3 = 7. Then #4 = 8, and the sequence leaves that pattern. Treating “the key is N” as a law is how people rediscover the first spent puzzles and stop. Instead — The folio publishes spent keys because they are public. Open puzzles are ranges, not nicknames.
Search uncompressed public keys; maybe the catalog used the other encoding.
Why it fails — The 160 records are compressed P2PKH. Spent keys in this catalog verify against the compressed point. Scanning uncompressed hashes is a different address, a different HASH160, and not these coins. Instead — Compressed. Always, for this set.
A 96-bit kangaroo window is the whole of #140.
Why it fails — #140 is a 2139 interval. A 96-bit window covers 296 of those keys. Containment is 296−139 = 2−43 — about 1 in 8.80 trillion (short scale). You are not searching the puzzle. You are searching a slice. Instead — State the width w (in bits) and the containment first, then the budget. The public RCKangaroo README documents an expected-work heuristic of about 1.15 × 2w/2 = 1.15 × sqrt(range) group operations for a window whose range has 2w keys — an implementation constant to cite, not a theorem. Then decide whether a ticket is worth the rent.
Finishing the kangaroo budget proves the window was empty.
Why it fails — RCKangaroo’s README documents a named expected-work heuristic of about 1.15 × 2w/2 group operations to find a key that is in a window of 2w keys. That is not an ideal or universal kangaroo cost, and it is not a proof of full enumeration. The atlas 2√N heuristic (same order as van Oorschot–Wiener (2+o(1))√N) lives on the method and glossary pages; do not collapse those to 1.15. Tuning parameters, collisions in the distinguished-point table, and plain software bugs all sit between “the job exited 0” and “every scalar was visited.” Instead — Treat a finished window as a ticket you played, not as a theorem. Deduplicating work across machines is coordination, not enumeration of the interval.
Start scanning from key 1, or from the start of secp256k1.
Why it fails — Puzzle N lives in [2N−1, 2N − 1]. Keys below that floor hash to other addresses. Scanning from 1 re-solves #1–#70, which are spent. Instead — The folio prints the hex start and end. That is the walk.
The public key is n·G written as a WIF, or WIF is what you kangaroo against.
Why it fails — WIF is a Base58Check encoding of a private key (plus a compressed flag). The public key is a 33-byte compressed point. Kangaroo takes that point. Pasting a WIF into a “pubkey” field is a class of forum mistake with its own Stack Exchange trail. Instead — On a spent record this catalog lists the compressed public key and the historical solved scalar as two different objects. WIF is a private-key encoding, and it is never what a kangaroo operates on. This site never asks for anything of that kind.
Claim & operations
How coins are actually taken. A website cannot claim them for you.
Paste the hex into a website to “check” it or convert to WIF.
Why it fails — If the key is live, you just handed the coins to whoever logs the form. Spent keys are already public; live keys are not. Online converters are a common drain. Instead — Verify on a machine you control. Never paste a live private key into a website — including this one. This atlas will not ask.
Sweep with Electrum / a public broadcast. First to the mempool wins.
Why it fails — A legacy P2PKH spend puts the public key in the scriptSig before confirmation. Anyone who recovers the scalar in time can issue a conflicting spend. That publication race is real. Confirmed spends on #66 and #69 are clustered different UTXOs, not two confirmed spends of one outpoint. Instead — Treat a public mempool broadcast as a publication event. The claim page names the channel; it is not a recipe.
Join a pool; if the pool hits, you are paid a share of the BTC.
Why it fails — A solo pool coordinates ranges. The coins sit on a P2PKH address. Whoever first produces a valid spend of that key takes them. There is no protocol-level share. A pool token is not the prize. Instead — btcpuzzle.info is a third-party pool with ads and its own token (retrieved 2026-09-11). This atlas is not a pool. If you hunt, the coins are yours only if you sign the spend yourself.
The BCPZ (or similar) token is the puzzle reward.
Why it fails — The prize is the UTXO on the puzzle address, in bitcoin. A site token is a site token. Mixing them is how a pool looks like a vault. Instead — Read the address on an explorer. That number is the only prize this catalog talks about.
This site (or any tracker) can claim the coins for you if the explorer shows a balance.
Why it fails — A balance is a UTXO. Spending it needs the private key. A catalog cannot sign. An explorer cannot sign. A “claim” button on a random domain is a paste trap. Instead — The claim page is a procedure you run on hardware you control. There is no button that pays you.
Buy puzzle shares, cloud key-finders, or a “guaranteed scan.”
Why it fails — You are buying someone else’s screenshot of a GPU. You do not hold the key if they find it. “Guaranteed” enumeration of #71 is a claim that contradicts the interval. Instead — If you still want to play, run the compute on hardware you control, keep any key off machines you do not own, and follow the claim procedure.
Claim via Taproot / P2TR / Lightning; it is safer or faster.
Why it fails — The coins are on a legacy P2PKH address. You spend that script, then you may send onward however you like. You cannot “claim” them with a different output type without first signing the P2PKH. Instead — One transaction that empties the puzzle UTXO to an address you own. Then you are free.
Wrong object
This catalog is the 2015 P2PKH set. Other “puzzles” are other objects.
Find any spent key and the next open one falls out of the wallet.
Why it fails — Even if consecutive derivation from one seed is true, HMAC(seed ∥ index) does not invert from one output. Consecutive is the index, not the integer. Each open puzzle remains its own range for everyone who is not the seed holder. Instead — The reading is recorded on Theories as refuted, under the deterministic wallet and “one found key unlocks the rest.”
saatoshi_rising lied; there is a closed-form pattern.
Why it fails — Anyone may say that. Spent keys after #3 do not look like 2N − 1. A pattern that only fits the first four is a description of the first four. It is not a method for #71. Instead — If you have a closed form, it has to hit an open address before it is a method. Theories keeps those stories labelled.
Keys sit near the start of the range, so scan the floor first.
Why it fails — #69 landed at 0.72% of its interval. That is one sample. It is not a law. A generator plus an N-bit mask puts the scalar somewhere in the bucket; the floor is not privileged. Instead — If you bias the floor, write that bias into your expected value. Do not call it a reduction.
The August 2026 genesis OP_RETURN puzzle is this hunt.
Why it fails — Different date, different script, different key. This atlas is the 2015-01-15 P2PKH set in transaction 08389f34…cd15. Instead — If you are here for the 160 addresses, stay on the catalog. Theories has a mix-up card for the rest.
False hope / EV
Larger prizes sit behind larger intervals. Expected value is usually negative.
Higher N is better expected value because the prize is larger.
Why it fails — Prize scales with N. The interval doubles every step. Address-only work is linear in the interval. Kangaroo, when a public key exists, is exponential in half the window, and the window is not the range. Larger prize, much larger work. Instead — Open the EV calculator. For most rentals the number is negative. That is the honest headline.
#160 without a public key is a practical brute-force target.
Why it fails — #160 is a 2159 interval. Address-only brute force at tens of billions of keys per second does not inventory that set. #160 is in the catalog as a kangaroo target because the 2019 leak published its public key — still a 2159 discrete log, searched only in chosen windows. Instead — Address-only work with current brute force: #71. Known public key: #140 first, and only inside a window you chose. Anything higher is a ticket, not a plan to finish.
#71 is “next,” so it is due, and therefore easier this year.
Why it fails — The interval does not care about the calendar. #66–#69 being spent tells you those ranges were searched, sniped, or lucked. It does not shrink 270. “Due” is a gambler’s sentence. Instead — The lowest open address-only record in this catalog's snapshot is #71 because every lower record is listed there as spent. That is ordering, not a discount.