Scale
The work, on log2
Each increment of N doubles the interval. #72 is twice #71, not a rounding error. On a log2 ruler, bar length is search bits N−1, with #160 at 159. Address-only search of 2159 is not practical. #160 in this catalog is a known-public-key target from the 2019 leak; full-interval kangaroo is still not a weekend of work.
Doubling, not a mild slope
Interval width for puzzle N is 2N−1. Adding one to N multiplies the candidate list by two. Linear charts of N hide that. A honest picture is log2 of the width, which is just N-1.
If you draw a bar whose length is (N-1)/159 of the full ruler, #71 is 70/159 of the way to #160 on the log. It is not 71/160 of the work. The remaining address-only puzzles sit on that same doubling ladder.
This page does not print a live census of unsolved rows. Open the catalog for current status. The landmarks below are arithmetic identities, true whether a row is still open or already spent.
Landmarks on the ruler
Five widths that fix the scale. Hex endpoints belong in the range tool; here the power of two is the point.
#1 — width 1
Interval [1, 1]. Search bits 0 in the N-1 sense; a single scalar. Useful as the origin of the catalog, not as a model of later work.
#71 — width 270
Address-only class in this catalog. Expected exhaustive HASH160 work about 269 if the key is uniform. #72 is twice that list, not a rounding error past #71.
#72 — twice #71
Width 271. One increment, twice the candidates. People who treat N as a score miss this step. Every later address-only increment does it again.
#140 — width 2139
Known public key in this catalog. Exhaustive HASH160 of the full interval would be 2139 candidates. Kangaroo expected group operations on the whole interval are on the order of 2 * sqrt(2139) = 2 * 269.5, which is still huge, which is why people talk about w-bit windows — and why containment then collapses as 2w−139.
#160 — width 2159
The end of the 2015 series. Catalog class: known public key (2019 leak), not address-only. A hypothetical address-only search of 2159 candidates is not practical. Kangaroo expected work on the full interval is on the order of 2 * 279.5 group operations under the atlas 2√N heuristic, which is a different unit and still not a weekend. This atlas does not convert those powers into rental hours or hardware SKUs.
Same log, two units of work
Address-only rows and known-public-key rows share the doubling ladder and do not share an algorithm. Plotting both as bars of length N-1 is fair for keyspace and unfair if you then read the bar as time.
HASH160 scan: one candidate, one compressed point, one hash, one compare. Time scales with keys tried.
Kangaroo or BSGS: group operations against known P. Time scales with about 2 * sqrt(interval or window). A short bar on the log is still only short in bits, not in wall-clock, and a long bar with a public key is not automatically easier than a short bar without one until you write both numbers down.
2019 leak map
16 May 2019: 21 outputs of 1,000 sat. A receive does not leak. 1 June 2019: a 21-input spend; the scriptSig does. Catalog series: every fifth address from #65 to #160 — twenty addresses. Twenty of the 21 deposit outputs went to that series plus #1 (1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH). The spend consumed those 20 series outputs and one other input, 1PvaqLqRAivje7CactLR55xQBYvBeaDrXN, which is not #1 and not in the 2015 256-output set.
Spot-checked on mempool.space REST 2026-09-11: deposit block 576251 at 2019-05-16 04:25:45 UTC; spend block 578732 at 2019-06-01 02:07:26 UTC. #135 later spent in block 959946 at 2026-07-28 08:20:16 UTC.
At the 2026-09-11 chain spot-check the remaining public-key targets in that series were #140, #145, #150, #155, and #160. That list is snapshot state, not a promise that nothing else will move.
#65
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#70
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#75
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#80
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#85
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#90
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#95
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#100
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#105
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#110
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#115
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#120
Every-fifth series. Spent 2023-02-27 before the catalog-unit increase. Explorer figure about 1.20001 BTC funded and spent, not the later 12.0 catalog column.
#125
Every-fifth series. Spent 2023-07-09 after the increase. Explorer figure about 12.50004706 BTC funded and spent. Do not confuse the 2019-06-01 pubkey leak date with the spend date.
#130
Every-fifth series. Public key in this catalog from the 2019-06-01 spend.
#135
Every-fifth series. Spent 2026-07-28, block 959946, 08:20:16 UTC. ScriptSig public key matches the catalog.
#140
Every-fifth series. Remaining public-key target at the 2026-09-11 chain spot-check. Width 2139.
#145
Every-fifth series. Remaining public-key target at the 2026-09-11 chain spot-check. Width 2144.
#150
Every-fifth series. Remaining public-key target at the 2026-09-11 chain spot-check. Width 2149.
#155
Every-fifth series. Remaining public-key target at the 2026-09-11 chain spot-check. Width 2154.
#160
Every-fifth series. Remaining public-key target at the 2026-09-11 chain spot-check. Width 2159.
What square-root does not erase
Kangaroo replaces a list of size W with expected group operations about 2 * sqrt(W) under the atlas heuristic (same order as van Oorschot–Wiener (2+o(1))√N). That is a named constant, not RCKangaroo’s 1.15 README figure, and not a smaller #71. A 96-bit window on #140 is about 2 * 248 group operations for the window and containment 1 in 8,796,093,022,208 against the puzzle.
Hitting 50 percent on #140 with independent 96-bit windows needs on the order of 242.5 such windows if containment is 2−43. That aggregate is far larger than one wide-interval kangaroo on the full 2139. Window shopping is not a substitute for stating containment.
No hardware table lives here. Rate is whatever machine you actually measure. Mining SHA-256d ASICs are not on this ruler.
Tools on this scale
Range prints exact hex endpoints. Compare draws the log. Kangaroo separates window, containment, and budget. Expected value needs a rate and a nominal prize, not a live ticker.