Bitcoin puzzle transaction ~32 BTC prize to who solves it

[citb0in]

Disclaimer, I take no responsibility for any damages caused by my published studies, I am an independent researcher and publish my findings on public domain.  For transparency.

Can you point us to your published studies? I'm really curious and looking forward reading them.

[nomachine]

Disclaimer, I take no responsibility for any damages caused by my published studies, I am an independent researcher and publish my findings on public domain.  For transparency.

Can you point us to your published studies? I'm really curious and looking forward reading them.

It's a waste of reading until he shows us the solved WIF. 

[btc11235]

Hi -- Is anyone here familiar with NBitcoin for .NET? I basically only know C# so I'm hoping someone can help me with this one step I'm stuck on...

I'm testing with puzzle #12 just to see if I can generate the right address from the now-known private key... Private key and funded address are listed as:

Code:

0000000000000000000000000000000000000000000000000000000000000a7b
1DBaumZxUkM4qMQRt2LVWyFJq5kDtSZQot

However, the following code keeps giving me a different address:

Code:

var hex = "0000000000000000000000000000000000000000000000000000000000000a7b";
var privateKey = new ExtKey(hex);

// these all give me: "1JThwYZMjCqbpi3QPNAToGdbSLWoUdhdJi"

privateKey.GetPublicKey()
          .GetAddress(ScriptPubKeyType.Legacy, Network.Main)
          .ToString();

privateKey.PrivateKey
          .GetAddress(ScriptPubKeyType.Legacy, Network.Main)
          .ToString();

privateKey.PrivateKey
          .PubKey
          .GetAddress(ScriptPubKeyType.Legacy, Network.Main)
          .ToString();

privateKey.PrivateKey
          .GetScriptPubKey(ScriptPubKeyType.Legacy)
          .GetDestinationAddress(Network.Main)
          .ToString();

privateKey.PrivateKey
          .GetWif(Network.Main)
          .GetAddress(ScriptPubKeyType.Legacy)
          .ToString();

Thanks in advance... I was making really solid progress all morning, then hit this inability to generate an address I can reliably use to match against the known-funded addresses of the remaining puzzles, and without that I'm basically dead in the water... I can guess all the private key hashes I want, within the range I want (for puzzle #66 currently), but who cares if I can't verify whether I hit the right one?!

[btc11235]

Hi Legends_Never_Die -- Thx for the reply!

You are trying to generate a master private key > ExtKey.

Ah, I see. I'm afraid I've never heard of a "master private key" before...

Do you know how would I generate a... well, now I don't know what to call it... but a "regular" private key from a hex? I just need to give NBitcoin that hex and then get the expected address from it, and I was using this StackOverflow as an example, which is using `ExtPubKey` to generate a public key from some kind of hash, so I "extrapolated" (aka assumed) that `ExtKey` would be the private key version of that... But I guess that was wrong Although one of the overrides for `new ExtKey()` does take a `hex` param, so I really thought I was on the right track...

And I checked out that link to csharp.hotexamples.com you posted (thank you for that) but I can't seem to navigate that site very well to get to any other pages that might be helpful (I tried the search, but almost everything I tried gave me a 404)...

I do see this on that page:

Code:

var walletKey = new NBitcoin.Key();

...and I'm guessing that could be mean I just need to use a `Key()` instead of a `ExtKey()`...? but `Key()` doesn't seem to take a hex value at all... and `Key.Parse()` takes a WIF, but I'm not sure how to generate a WIF from a private key hex either, so, yeah, I'm still stumped...

why are you trying to build from scratch when there are ready to use open source tools, with great performance?

If you mean use an existing puzzle solver, well A) to learn all this stuff, but also B) I really don't know where to find existing ones...? And the code I've seen posted here all looks like C or C++ that I'm not very familiar with, so I wouldn't know how to modify any of it to do what I want...

Thanks again for the response, and let me know if you can help me get from a private key (in either decimal or hexadecimal form) to the funded address using C# ... doesn't even have to be with NBitcoin, that just seems to be the most popular Bitcoin lib for .NET


Did it! Thanks to this SO post I finally found:

https://stackoverflow.com/questions/74753526/get-private-key-from-a-biginteger-in-nbitcoin

So I can use the decimal version of that hex, 2683, and do this:

Code:

var bytes = new BigInteger(2683).ToByteArray();
Array.Resize<byte>(ref bytes, 32);
Array.Reverse(bytes);

new Key(bytes)
    .GetAddress(ScriptPubKeyType.Legacy, Network.Main)
    .ToString();

...which returns the expected (previously funded) address of "1DBaumZxUkM4qMQRt2LVWyFJq5kDtSZQot", and the added bonus is that I don't have to convert the BigInteger numbers I already had into HEX strings after all 

[moderator's note: consecutive posts merged]

[digaran]

Here visit this other puzzle thread, there are all the intel you need about cracking tools, but may I interest you about a sets of earth shattering ultimate hack tools developed by myself by skiing on people's script and claiming them as mine? It's free to use you only have to cover my back, like when whiners start their routine whining, you just come here taking my side, Ok? I feel like cornered.😂
I'm currently working on a new thing, I'm trying to find ending characters or at least 2 last chars of a private key, it's really difficult but God willing if I manage to figure that out, I will do absolutely nothing with it just like I haven't followed up on changing a key in a way to make a composite number divisible by up to 2^240, though I know how to do it, but it only works for keys with at least first 28-32 characters being 0xf.

As I said before, if you try to divide 2 keys and subtract/add the results, you would either get their sum, which is sometimes less than 34-38 in hex, or you would actually get their subtracted value. Something interesting is the fact about dividing a key, has anyone managed to divide 1 through 15 by different divisor to see the left most characters of resulting scalar?  Yeah do that and you will realize the starting hex chars of your result depends on the ending chars of your target.

[nomachine]

I'm currently working on a new thing, I'm trying to find ending characters or at least 2 last chars of a private key, it's really difficult but God willing if I manage to figure that out......

Only 2 ?  

Code:

import sys
import os
import time
import secrets
import random
import binascii
import base58
import hashlib
import ecdsa
import multiprocessing
from multiprocessing import cpu_count

def generate_private_key_WIF(start, miss):
    return start + "".join(
        secrets.choice(
            "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
        )
        for _ in range(miss)
    )

def check_private_key(start, miss, target_binary):
    while not STOP_EVENT.is_set():  
        private_key_WIF_str = generate_private_key_WIF(start, miss)
        if start[0] == '5':
            private_key_WIF = private_key_WIF_str
            first_encode = base58.b58decode(private_key_WIF)
            private_key_full = binascii.hexlify(first_encode)
            private_key = private_key_full[2:-8]
        if start[0] in ['L', 'K']:
            private_key_WIF = private_key_WIF_str
            first_encode = base58.b58decode(private_key_WIF)
            private_key_full = binascii.hexlify(first_encode)
            private_key = private_key_full[2:-10]
        private_key_hex = private_key.decode("utf-8")
        dec = int(private_key_hex[0:64], 16)
        dec_bytes = dec.to_bytes((dec.bit_length() + 7) // 8, 'big')
        private_key_bytes = b'\x00' * 32
        private_key_bytes = private_key_bytes[:-len(dec_bytes)] + dec_bytes
        signing_key = ecdsa.SigningKey.from_string(private_key_bytes, curve=ecdsa.SECP256k1)
        compressed_public_key = signing_key.get_verifying_key().to_string("compressed")
        sha256_hash = hashlib.sha256(compressed_public_key).digest()
        ripemd160_hash = hashlib.new('ripemd160', sha256_hash).digest()
        extended_private_key = b'\x80' + private_key_bytes + b'\x01'
        checksum = hashlib.sha256(hashlib.sha256(extended_private_key).digest()).digest()[:4]
        private_key_with_checksum = extended_private_key + checksum
        wif_compressed = base58.b58encode(private_key_with_checksum).decode()
        message = "\r[+] {} ".format(private_key_WIF_str)
        messages = []
        messages.append(message)
        output = "\033[01;33m" + ''.join(messages) + "\r"
        sys.stdout.write(output)
        sys.stdout.flush()
        if ripemd160_hash == target_binary:
            t = time.ctime()
            sys.stdout.write(f"\n\033[01;33m[+] BINGO!!! {t}\n")  
            with open('winner.txt', 'a') as file:
                t = time.ctime()
                file.write('\n\nMatch Found: ' + t)
                file.write('\nPrivatekey (dec): ' + str(dec))
                file.write('\nPrivatekey (hex): ' + hex(dec)[2:])
                file.write('\nPrivatekey (wif): ' + wif_compressed)
                
            STOP_EVENT.set()  
            return  

if __name__ == '__main__':
    start = "KwDiBf89QgGbjEhKnhXJuH7LrciVrZi3qZM21gaY8W"
    miss = 52 - (len(start))
    # Define the target as bytes
    target_hex = "52e763a7ddc1aa4fa811578c491c1bc7fd570137"
    target_binary = bytes.fromhex(target_hex)
    os.system("clear")
    t = time.ctime()
    sys.stdout.write(f"\033[01;33m[+] {t}\n")
    sys.stdout.write(f"\033[01;33m[+] Ending characters missing: {miss}\n")
    sys.stdout.write(f"\033[01;33m[+] Public Key Hash (Hash 160): {target_hex}\n")
    sys.stdout.flush()

    # Create a global STOP_EVENT
    STOP_EVENT = multiprocessing.Event()

    # Create a pool of worker processes
    num_processes = multiprocessing.cpu_count()
    pool = multiprocessing.Pool(processes=num_processes)

    # Start the worker processes with different starting points
    for i in range(num_processes):
        pool.apply_async(check_private_key, args=(start, miss, target_binary))

    # Close the pool and wait for all processes to complete
    pool.close()
    pool.join()

• Mon Oct 23 00:26:17 2023
• Ending characters missing: 10
• Public Key Hash (Hash 160): 52e763a7ddc1aa4fa811578c491c1bc7fd570137
• KwDiBf89QgGbjEhKnhXJuH7LrciVrZi3qZM21gaY8WN2CdwnTG57
• BINGO!!! Mon Oct 23 00:26:20 2023

[digaran]

BINGO

Why are you brute forcing WIF? Don't you know going beyond public key generation is wasting time if you don't have enough hardware? It would be nice if you could write a script which could with 100% validity tell you the last 2 characters of a private key by operating with points.

I can find them when I know both keys, or when I only know the distance between 2 points, it also doesn't matter what the distance is, that's why working with all hexadecimal values is important to find out and study the behaviour of each character. After preliminary test, God willing I will post my method if I think it doesn't break the EC.  But funny thing is most of the things I post (ECC math related) I truly believe they "have" the potential but I just post them to see maybe an expert can get an idea out of it. Apparently I'm delusional until I'm not. By then it'd be too late to pay attention.

[nomachine]

BINGO

Why are you brute forcing WIF?

To demonstrate to you that even 10 is not a problem.
The problem is that we are not dealing here with 2, 6, 8 or 10 missing characters...
But with 18 specifically for Puzzle 66.....
It is useless, whatever method you use.

[citb0in]

Disclaimer, I take no responsibility for any damages caused by my published studies, I am an independent researcher and publish my findings on public domain.  For transparency.

Can you point us to your published studies? I'm really curious and looking forward reading them.

@digaran: the question unfortunately is still unanswered. Can you point us to your studies, please?

[vhh]

Something interesting is the fact about dividing a key, has anyone managed to divide 1 through 15 by different divisor to see the left most characters of resulting scalar?  Yeah do that and you will realize the starting hex chars of your result depends on the ending chars of your target.

These are natural behaviors when you're working on a curve over a finite field. You need to study them more (properties of curves over prime fields, pairings, embedding degree, etc) in order to avoid attributing a magical aura to every result that pops out.

[digaran]

BINGO

Why are you brute forcing WIF?

To demonstrate to you that even 10 is not a problem.
The problem is that we are not dealing here with 2, 6, 8 or 10 missing characters...
But with 18 specifically for Puzzle 66.....
It is useless, whatever method you use.

I'm not talking about missing characters or puzzle 66, I'm talking about a way to determine last characters of a private key by working with points.

These are natural behaviors when you're working on a curve over a finite field. You need to study them more (properties of curves over prime fields, pairings, embedding degree, etc) in order to avoid attributing a magical aura to every result that pops out.

There is no magical aura, and there is no natural behaviour, everything depends on group order, working with points without working on scalar is pointless, in reality we don't need to work with points alone, but since we don't know the private key we work with points.

E.g, if you divide 16577/7 = 2368.142857, divide 16477/7 =
2353.857143, now dividing 16576/7 = 2368, now all we need to do is finding what key results in 0.142857 and 0.85143 when divided, and by what number. After that having all keys between 2353 and 2368 saved for comparing is easy.  This is just an example.

[mcdouglasx]

Main question is, how can we guess the first few digits? If even if we guess the 4 first digits correctly, the fifth digit would cause a problem if we make a mistake.

sincerely i have not investigated much in this technique, due to lack of time.
I only know that dividing by 5 with this technique, you will not worry about floating numbers.
I have applied the technique in 2 rounds and everything seems to be on the right track.
honestly do not know how many rounds are possible, but in my opinion it is a good idea.

Code:

x=2000000000000000
t=1185429467683753

A0=x-t
>>814570532316247

A1=t/5
>>237085893536750.6
A2=A0/5
>>162914106463249.4

A3=t-A1
>>948343574147002.4
A4= A0-A2
>>651656425852997.6


A5=A4-A1
>>785429467683753

A6=A3-A2
>>414570532316247

#---------------------------

t=A5
>>785429467683753
A0=A6
>>414570532316247

A1=t/5
>>157085893536750.6
A2=A0/5
>>82914106463249.4

A3=t-A1
>>628343574147002.4
A4= A0-A2
>>331656425852997.6


A5=A3-A2
>>545429467683753

A6=A4-A1
>>414570532316247

we obtain.
target=1185429467683753
  R=      545429467683753

[nomachine]

I'm not talking about missing characters or puzzle 66, I'm talking about a way to determine last characters of a private key by working with points.

Ok.

I'm working on Kangaroo Twimi algorithm on  hash160.
I don't know if it will work, but this is an idea.
It uses two EC_POINT objects (K and W) and iteratively moves them around the elliptic curve by adding random steps until they land on the same point.
When the Kangaroo and Wallaby points collide, the algorithm returns the discrete logarithm k.

Code:

bool kangarooTwimi(const EC_GROUP* group, const BIGNUM* order, BIGNUM* x, BIGNUM* result) {
    BIGNUM* k = BN_new();
    BIGNUM* k1 = BN_new();
    BIGNUM* k2 = BN_new();
    BIGNUM* x1 = BN_new();
    BIGNUM* x2 = BN_new();

    // Set k to a random value
    BN_rand_range(k, order);

    EC_POINT* G = EC_POINT_new(group);
    EC_POINT* kG = EC_POINT_new(group);
    EC_POINT* xG = EC_POINT_new(group); // Create an EC_POINT for x

    EC_POINT_mul(group, G, k, NULL, NULL, NULL); // G = k * G

    while (true) {
        EC_POINT_mul(group, kG, NULL, G, k, NULL); // kG = k * G

        // Use EC_POINT_mul to compute xG = x * G
        EC_POINT_mul(group, xG, NULL, NULL, x, NULL);

        // Extract affine coordinates
        EC_POINT_get_affine_coordinates_GFp(group, kG, k1, NULL, NULL);
        EC_POINT_get_affine_coordinates_GFp(group, xG, x1, NULL, NULL);

        if (BN_cmp(k1, x1) == 0) {
            BN_copy(result, k);
            BN_free(k);
            BN_free(k1);
            BN_free(k2);
            BN_free(x1);
            BN_free(x2);
            EC_POINT_free(G);
            EC_POINT_free(kG);
            EC_POINT_free(xG);
            return true;
        }

        BN_add(k, k, BN_value_one());
    }
}

rest is similiar as Bytea HASH160 Search from here :
https://bitcointalk.org/index.php?topic=1306983.msg63029958#msg63029958

100% OpenSSL code...

[digaran]

Main question is, how can we guess the first few digits? If even if we guess the 4 first digits correctly, the fifth digit would cause a problem if we make a mistake.

sincerely i have not investigated much in this technique, due to lack of time.
I only know that dividing by 5 with this technique, you will not worry about floating numbers.
I have applied the technique in 2 rounds and everything seems to be on the right track.
honestly do not know how many rounds are possible, but in my opinion it is a good idea.
........
we obtain.
target=1185429467683753
  R=      545429467683753

Will this work with your script of dividing by 3 you have posted before? Or do you have a script for this one as well?

Ok.
I'm working on Kangaroo Twimi algorithm on  hash160.
I don't know if it will work, but this is an idea.
It uses two EC_POINT objects (K and W) and iteratively moves them around the elliptic curve by adding random steps until they land on the same point.
When the Kangaroo and Wallaby points collide, the algorithm returns the discrete logarithm k.
.....
 rest is similiar as Bytea HASH160 Search from here :
https://bitcointalk.org/index.php?topic=1306983.msg63029958#msg63029958

100% OpenSSL code...

I wish I knew anything about coding, I could give my opinion, but your idea is great, I can work on different values until I get a result, but could you also work on a scalar mod n script alone please?  I mean just scalar mod n, no EC involved, scratch that, I believe if you can write a script where it takes both scalar and points and does the magic on both but with the ability to output points for scalar results.  If you don't understand me, I will explain later, I'm in pain now for walking a lot today.😉

Anyone knows anything with more fire power than sage cell or google colab etc? I'm running some scripts on them but they can't handle the load, I'm trying to find lambda and beta for different curve parameters, mapping points from secp256k1 to a 128 bit curve to see if it can be done.  
I was thinking, why there is no such infrastructure like sage cell, or Gcolab etc already available for blockchain/Bitcoin developers to use?
Should we all appeal to our beloved dragon to sponsor something like that?  I think if we all collectively ask nicely he will make it happen, right? 😉
[Digaran's note, consecutive posts merged due to another post being removed from between my posts.] 😉

[nomachine]

I wish I knew anything about coding

If you think realistically there are at least 10,000 programmers trying to solve the Puzzle 66 at the same time.
The result is visible on the blockchain:
https://www.blockchain.com/explorer/addresses/btc/13zb1hQbWVsc2S7ZTZnP2G4undNNpdh5so
They are helpless for now to solve any Puzzle from 66 and above  that does not have a Public Key displayed.
And if they have,  everything above 130 it is simply impossible to solve without huge investments that do not pay off.
So it doesn't really matter here if you know how to code or not. We are all equal in the face of an unsolvable problem.

Anyone knows anything with more fire power than sage cell or google colab etc? I'm running some scripts on them but they can't handle the load

Don't try to do that on shared services. Even if you have a large load on dedicated servers,  it can happen that you get banned from the same.

[AlanJohnson]

I wish I knew anything about coding

If you think realistically there are at least 10,000 programmers trying to solve the Puzzle 66 at the same time.
The result is visible on the blockchain:
https://www.blockchain.com/explorer/addresses/btc/13zb1hQbWVsc2S7ZTZnP2G4undNNpdh5so
They are helpless for now to solve any Puzzle from 66 and above  that does not have a Public Key displayed.
And if they have,  everything above 130 it is simply impossible to solve without huge investments that do not pay off.
So it doesn't really matter here if you know how to code or not. We are all equal in the face of an unsolvable problem.

Anyone knows anything with more fire power than sage cell or google colab etc? I'm running some scripts on them but they can't handle the load

Don't try to do that on shared services. Even if you have a large load on dedicated servers,  it can happen that you get banned from the same.

^^^^^ This is the best and logical answer on this forum ^^^^^^

Most people here just wasting their time trying to solve things that are unsolvable with current hardware (at least hardware available to them).

Even using blind random cracking - realistically it's not gonna be solved in any sane amount of time.

[digaran]

Most people here just wasting their time trying to solve things that are unsolvable with current hardware (at least hardware available to them).

Even using blind random cracking - realistically it's not gonna be solved in any sane amount of time.

Agreed, with current tools it's the same as before, extremely difficult to solve the DLP, but one has to penetrate deep into the unknown territories of math and elliptic curves, then you will realize everything is in the group order N, for each curve you'd need to find the weaknesses of N instead of G, or P.
Just to show one example, take this key  :

Code:

000000000000000000000000000000014551231950b75fc4402da1732fc9bebf

When you first look at it, what do you think would happen if you divide it by 2? Normally you'd say a key with 31 leading zeros. But in reality the result mod n is :

Code:

8000000000000000000000000000000000000000000000000000000000000000

Can you see the difference? There are also other hidden properties, keys etc.
One thing you should think about, is there a way to reduce a number to a perfect composite number and then easily dividing that composite number to reach a range close to 2^65? I believe with a certain subtraction tricks, we can do that, I have done it, but I know the key so it doesn't count, I want to know how to operate with 2 unknown points without knowing the distance between them, whether or not we can reach a composite point as a result of either subtraction and or division.  Like : 59, if we know the range, we could subtract it from 100 to have 41, now all we need is to subtract 9 from 41 to get to 32, and now we can safely divide 32 by 2 a few times to reach 8, where 8 is our desired small range where we can brute force under an hour. The question is, how can we determine that 9 is the right key to reach 32? By operating with scalar mod n of course, first we study and learn then we go for our targets in points.

[AlanJohnson]

Just to show one example, take this key  :

Code:

000000000000000000000000000000014551231950b75fc4402da1732fc9bebf

When you first look at it, what do you think would happen if you divide it by 2? Normally you'd say a key with 31 leading zeros. But in reality the result mod n is :

Code:

8000000000000000000000000000000000000000000000000000000000000000

Can you see the difference? There are also other hidden properties, keys etc.
One thing you should think about, is there a way to reduce a number to a perfect composite number and then easily dividing that composite number to reach a range close to 2^65? I believe with a certain subtraction tricks, we can do that, I have done it, but I know the key so it doesn't count, I want to know how to operate with 2 unknown points without knowing the distance between them, whether or not we can reach a composite point as a result of either subtraction and or division.  Like : 59, if we know the range, we could subtract it from 100 to have 41, now all we need is to subtract 9 from 41 to get to 32, and now we can safely divide 32 by 2 a few times to reach 8, where 8 is our desired small range where we can brute force under an hour. The question is, how can we determine that 9 is the right key to reach 32? By operating with scalar mod n of course, first we study and learn then we go for our targets in points.

I'm afraid this is the whole point where all that cryptography works. If you would be able to crack it in an easy way - it would be useless.

Maybe you are some kind of mathematical genius and you will discover something new ... But i guess there is a bunch of much smarter people than you trying to resolve such problems and since larger puzzles are still on their places they didn't invented anything new.

[nomachine]

It might be possible mathematically speaking :

https://arxiv.org/pdf/2302.06639.pdf

Technologically speaking....

We don't have the hardware (arithmetic circuits) available for "126 133 Cat Qubits"  

[AlanJohnson]

It might be possible mathematically speaking :

https://arxiv.org/pdf/2302.06639.pdf

Technologically speaking....

We don't have the hardware (arithmetic circuits) available for "126 133 Cat Qubits"  

Let's back to earth...

At some point I had an idea (probably very stupid cause i'm complete nood in maths)

In few program (like keyhunt, bitcrack) there is an option  called STRIDE.

As I understand that option simply defines a step (it skips given value) in searching for private key.

Normally scanning a large range (like puzzle 66) is impossible with home computer. But when we use quite high stride we can search the whole range in matter of seconds. (of course it will skip massive amount of keys)

And here is my thought: Let's say we have a 66 bit private key. Such key must be a multiple of smaller number. What if we use STRIDE option big enough to very fast scan the whole range and that stride value would be a number that multiplied is our private key ?

Now, some may say ... but how do you know which exactly STRIDE value use ?  And here my only answer is to write a program that would randomly generate STRIDE with given length (long enough to fast scan the whole range) and constantly seeking the range with new stride.

Can it work ? Or am i missing something here (i am sure i am missing something)