Bitcoin puzzle transaction ~32 BTC prize to who solves it

[And24r]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

Thanks, I'll check it out.

Grzegorz2022.
What do you think — is there a way to figure out whether a point is on the lower or upper branch of the curve, given that the generator point is on the upper branch?

[Grzegorz2022]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

Thanks, I'll check it out.

Grzegorz2022.
What do you think — is there a way to figure out whether a point is on the lower or upper branch of the curve, given that the generator point is on the upper branch?

There is a way to get a point in the lower half negation (just flip y, it's free). Given any point P (with scalar k), its negation -P has scalar n-k. One of them is always in the lower half, the other in the upper half. The problem is: you don't know WHICH one is in which half without knowing k. If someone could determine the parity of k from the public key alone, they could iteratively halve the scalar 256 times and recover the full private key breaking ECDLP entirely. This is exactly why this remains an open problem.
And this is where the modular wrap-around destroys information:
In normal math:
  6 / 2 = 3 (integer → you see it's even)
  7 / 2 = 3.5 (fraction → you see it's odd)
On the curve (mod n):
  6 × inv2 mod n = 3 (small, no wrap)
  7 × inv2 mod n = 578960...172 (256 bit! wrapped around n)
A small odd number like k=7 produces a 256-bit result after halving, identical in size to what a huge number like k=n-3 would produce. The wrap around mod n destroys all information about size, parity, and position of the original scalar.
This is exactly why ECDLP is hard modular arithmetic wraps the numbers and hides their structure.

[And24r]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

Thanks, I'll check it out.

Grzegorz2022.
What do you think — is there a way to figure out whether a point is on the lower or upper branch of the curve, given that the generator point is on the upper branch?

There is a way to get a point in the lower half negation (just flip y, it's free). Given any point P (with scalar k), its negation -P has scalar n-k. One of them is always in the lower half, the other in the upper half. The problem is: you don't know WHICH one is in which half without knowing k. If someone could determine the parity of k from the public key alone, they could iteratively halve the scalar 256 times and recover the full private key breaking ECDLP entirely. This is exactly why this remains an open problem.
And this is where the modular wrap-around destroys information:
In normal math:
  6 / 2 = 3 (integer → you see it's even)
  7 / 2 = 3.5 (fraction → you see it's odd)
On the curve (mod n):
  6 × inv2 mod n = 3 (small, no wrap)
  7 × inv2 mod n = 578960...172 (256 bit! wrapped around n)
A small odd number like k=7 produces a 256-bit result after halving, identical in size to what a huge number like k=n-3 would produce. The wrap around mod n destroys all information about size, parity, and position of the original scalar.
This is exactly why ECDLP is hard modular arithmetic wraps the numbers and hides their structure.

I’ll say more. The problem is that there are two square roots in modular arithmetic. That’s exactly why it’s impossible to determine which half‑plane the point is in. If there were only one square root, it would be possible to derive the y‑coordinate from the x‑coordinate and determine where the point on the curve is located.


It’s also interesting that if you multiply a point by 2, the half‑plane doesn’t change if the private key is not large or vice versa, it’s located almost at the end  There might be a mathematical formula that doesn’t multiply the point by 2 but instead shifts it by the first generator point in only one direction — closer to the point y=0 (although such a point doesn’t exist), regardless of the half‑plane.

In other words, we move only along the x‑coordinate, regardless of the y‑coordinate. This is exactly what the point doubling formula does. I hope you understand me.

[eggsylacer]

I also learned that, as it turns out, you can do some fun things with the curve y^2=x^3. For example, you can multiply a point by any rational number, or divide a point. You can square it or raise it to any power. Moreover, if you square a point, the y‑coordinate always ends up “positive”, in the upper half‑plane. You can even multiply a point by another point. There are specific formulas for that.

Raise this point 03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac to (1/2) power. Point(03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac)^(1/2) = ?

[And24r]

I also learned that, as it turns out, you can do some fun things with the curve y^2=x^3. For example, you can multiply a point by any rational number, or divide a point. You can square it or raise it to any power. Moreover, if you square a point, the y‑coordinate always ends up “positive”, in the upper half‑plane. You can even multiply a point by another point. There are specific formulas for that.

Raise this point 03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac to (1/2) power. Point(03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac)^(1/2) = ?

This point belongs to the elliptic curve y^2=x^3?


If this point relates to modular arithmetic, then it needs to be calculated. In general, the formula for squaring or raising to another power is as follows: divide the x‑coordinate of the base point by the x‑coordinate of any point on the curve, then raise the result to the power of two (or another power), and then divide the x‑coordinate of the base point by the resulting value after exponentiation. For the y‑coordinate, the process is similar — just replace x with y.

[eggsylacer]

If this point relates to modular arithmetic, then it needs to be calculated. In general, the formula for squaring or raising to another power is as follows: divide the x‑coordinate of the base point by the x‑coordinate of any point on the curve, then raise the result to the power of two (or another power), and then divide the x‑coordinate of the base point by the resulting value after exponentiation. For the y‑coordinate, the process is similar — just replace x with y.

Let's assume that this will work for the curve used in bitcoin. How will you perform such operations modulo P?

[And24r]

If this point relates to modular arithmetic, then it needs to be calculated. In general, the formula for squaring or raising to another power is as follows: divide the x‑coordinate of the base point by the x‑coordinate of any point on the curve, then raise the result to the power of two (or another power), and then divide the x‑coordinate of the base point by the resulting value after exponentiation. For the y‑coordinate, the process is similar — just replace x with y.

Let's assume that this will work for the curve used in bitcoin. How will you perform such operations modulo P?

This won’t work for the Bitcoin curve. I’ve checked it.

[speed_user_113]

1PWo3JeBsHrGnvdN72XscfNQPeAVDx8fB6
1PWo3JeB5mrGeFMsNER7W5H8rFSzp4RRUi
1PWo3JeBiHrGHnpy3ZghevtvTJif5WLsqR
1PWo3JeB7LrGamwKVDM4qcHQaidoCTu96v
1PWo3JeB9jrGMLiH83vD775NRqHZMR2hHB
1PWo3JeBFdrGZ6JoKtZrcW8TJYtn2F7pnG
1PWo3JeBS1rGSBfRFxPPr83NTpLiA5PUVw
1PWo3JeBvrrGMLhigKcRXm4Gayu5QSEqDc
1PWo3JeBoerGNAS8uZeGfu1TS8duo1G8Ev
1PWo3JeBX7rGbXSgqUfjXh2bGYBwGLUkkZ
1PWo3JeB8PrGTfbPKfSPVLBJeB3Jp6V11p
1PWo3JeBfyrGb2X4pr6CHRzhNhKKvKE4av
1PWo3JeBH3rGeE8oSvm1cpafbmLj4p8krq
1PWo3JeBWBrGxAkJJYvK8k1A6sXcZsuZoN
1PWo3JeBVHrGwJJrMLkFCk4bZRPB9aRj6K
1PWo3JeBJUrGGqPKwKSB72JDfLaA6DBBZ7
1PWo3JeB1DrGRBFXyfGLDSyviSDiLrV7Aq
1PWo3JeBqSrGnZLaVa7GQ3gQzjSADm8BeB
1PWo3JeBMbrGzxGXaKAJ49b3u4pfDsnnT3
1PWo3JeBcQrGCBsqiAVrNNGZiD1c5CkqUZ
1PWo3JeB9krGHLcaART1GMKmSk4pMyVgtr
1PWo3JeB9GrGNYJsBFFrmBEdt7XGpzxQdA

My script is almost there. I didn't had time to finish and run it completly, but this week i will let it running. This was found in the last 2 days by my script.

[abhi9100]

My script is almost there. I didn't had time to finish and run it completly, but this week i will let it running. This was found in the last 2 days by my script.
[/quote]               
       "What do you use? Which script do you use? Can you tell me?" iam search

[OzBtcOz]

1PWo3JeBsHrGnvdN72XscfNQPeAVDx8fB6
1PWo3JeB5mrGeFMsNER7W5H8rFSzp4RRUi
1PWo3JeBiHrGHnpy3ZghevtvTJif5WLsqR
1PWo3JeB7LrGamwKVDM4qcHQaidoCTu96v
1PWo3JeB9jrGMLiH83vD775NRqHZMR2hHB
1PWo3JeBFdrGZ6JoKtZrcW8TJYtn2F7pnG
1PWo3JeBS1rGSBfRFxPPr83NTpLiA5PUVw
1PWo3JeBvrrGMLhigKcRXm4Gayu5QSEqDc
1PWo3JeBoerGNAS8uZeGfu1TS8duo1G8Ev
1PWo3JeBX7rGbXSgqUfjXh2bGYBwGLUkkZ
1PWo3JeB8PrGTfbPKfSPVLBJeB3Jp6V11p
1PWo3JeBfyrGb2X4pr6CHRzhNhKKvKE4av
1PWo3JeBH3rGeE8oSvm1cpafbmLj4p8krq
1PWo3JeBWBrGxAkJJYvK8k1A6sXcZsuZoN
1PWo3JeBVHrGwJJrMLkFCk4bZRPB9aRj6K
1PWo3JeBJUrGGqPKwKSB72JDfLaA6DBBZ7
1PWo3JeB1DrGRBFXyfGLDSyviSDiLrV7Aq
1PWo3JeBqSrGnZLaVa7GQ3gQzjSADm8BeB
1PWo3JeBMbrGzxGXaKAJ49b3u4pfDsnnT3
1PWo3JeBcQrGCBsqiAVrNNGZiD1c5CkqUZ
1PWo3JeB9krGHLcaART1GMKmSk4pMyVgtr
1PWo3JeB9GrGNYJsBFFrmBEdt7XGpzxQdA

My script is almost there. I didn't had time to finish and run it completly, but this week i will let it running. This was found in the last 2 days by my script.

Your script? Funny user
1PWo3JeB9jrGMLiH83vD775NRqHZMR2hHB = 4DA0AA7F285F61B1C5

Give prefixes up collecting!

[speed_user_113]

I was expecting haters..of course...that address is from here from forum of course, but everything else is mine. It's a script and algorithm wrote by me.
Check also this pictures if are still from here from this forum all of them...maybe 1 or 2 are from here and added to my database, but the rest? Haters all the time....that do not see the point and just wait for a single error to hand to it...
My script is finding any 2 letters inside the address for the moment. So we will see what will happen next days.
And of course i have the private keys for those addresses in cse that another hater is saying is in photoshop

https://imgur.com/a/0nAzwaZ

[cctv5go]

Even if we find the private key for Puzzle 71 now, we still can't securely transfer the remaining funds because MARA isn't publicly available yet

[Menowa*]

Even if we find the private key for Puzzle 71 now, we still can't securely transfer the remaining funds because MARA isn't publicly available yet

Just apply for their client code

[eggsylacer]

Even if we find the private key for Puzzle 71 now, we still can't securely transfer the remaining funds because MARA isn't publicly available yet

I have a friend who has his own mining pool. He said that he had already made private transactions, but in any case, I'm not interested.

[ilgizilgiz]

Hello! I updated my app)

1 Scanner by pages like keys.lol
2 Puzzle solver.

Optimized code and boosted keys/per second

https://bitkeys.netlify.app

Preview image:
https://i.postimg.cc/xCwhqwqJ/Snimok-ekrana-2026-06-02-v-16-53-27.png

Source https://github.com/IlgizIlgiz/bitkee

Also added cli app for mac os

[analyticnomad]

Hello! I updated my app)

1 Scanner by pages like keys.lol
2 Puzzle solver.

Optimized code and boosted keys/per second

https://bitkeys.netlify.app

Preview image:
https://i.postimg.cc/xCwhqwqJ/Snimok-ekrana-2026-06-02-v-16-53-27.png

Source https://github.com/IlgizIlgiz/bitkee

Also addes cli app for mac os

Heh. Kinda cool. You ever find anything yet?

[HABJo12]

Please send me the Telegram Group link that have active chat on this Bitcoin puzzle transaction . Thanks

[8_2bp]

Hi everyone,

I've been reading this thread for two years. I want to share some thoughts that may bother some of you, but please read to the end before you start downvoting.

You've spent years analyzing this puzzle and after ONE single post from someone claiming "no pattern, just brute force", you all followed like sheep. Has anyone actually thought for themselves? Has anyone considered that the creator might be a genius who built something genuinely SIMPLE to solve — but only if you stop looking through a brute-force lens?

Let me share a few thoughts. In daily life I think nonlinearly, against patterns, which is why I've been studying this puzzle for hours every day since I discovered it. I know it might sound strange that nothing has been found — but I don't believe that's the case. I see something specific in this puzzle: a concrete pattern. I hope I'm not wrong, but like all of you I've analyzed the obvious things — seeds, brute force, simple solutions — and got nothing. Just like you.

After months of analyzing everything that's been studied before — de Bruijn sequences, Mersenne numbers, blocks, grids, triangles (left- and right-aligned), keys with leading zeros — I've covered nearly everything, and a few angles still remain. I might be one literal step away in some analysis and I'll keep going — but NOT the way most of you do, who think this is a brute-force puzzle.

I understand many of you will criticize me, but I use my head, and maybe you'll do the same — read this with reason and judge for yourselves.

BASIC OBSERVATIONS you should consider:

The creator built a puzzle with keys #1–256. Lower keys were fun to brute force, then code and GPU sites emerged. I see some of you experimenting and researching — I might be able to show what I've already covered. I have several hundred scripts and over 2,000 pages of analysis in a book I've been writing for two years. Maybe someone among you will find something in that analysis that I myself, after looping back so many times, may have missed.

But back to THE CREATOR.

Do you really think that in 2015, when the entire prize was worth roughly the cost of a good dinner at a restaurant, someone would build a brute-force puzzle? I don't. The creator was a GENIUS. Cryptography and coding were his passion, and he built this puzzle for colleagues in his field — to solve over a cup of coffee. The reward was symbolic. What matters is the SYMBOL and the STRUCTURE — like the perfect coupling of position index with exact bit-length without leading zeros.

The creator knew that the right bit-length without leading zeros throws each key into a specific bucket, and we get a clean partition into FOUR GROUPS. Has any of you noticed this? If yes — you're a master and you're thinking brilliantly. If no — you're probably just buying GPUs and searching.

So let's keep going with this "genius" theme. Has any of you asked yourself: WHY exactly 256 keys? Has anyone systematically studied repetitions, occurrences, duplicates? Has anyone actually READ saatoshi_rising's post and his reply and thought about what he was ACTUALLY saying?

Did he really not think about the RIPEMD160 issue with keys 161–256? I believe he did — and his statement was SARCASM. Someone who designed such a perfectly assembled puzzle could not POSSIBLY miss this. He had it all thought through, but he replied that way, and you couldn't read what he was actually trying to say.

OK, perhaps too much philosophy in one post. But you see — I think nonlinearly, and the creator inspired me, because what he built is something genuinely SIMPLE, worth the dinner-cost of the time and the moment of his attention — something he wanted to SHOW OFF, because no one would build such a structurally perfect puzzle that is actually unsolvable.

ONE MORE THING — if anyone tells me "it's random, the seed matters" — has any of you thought about something basic: HOW could the creator have generated a seed yielding keys with leading zeros, randomly but deterministically? Has any of you considered how hard it is to find a random vanity address, let alone generate a private key with leading zeros? Did it occur to you that those leading zeros SHOW that the creator was building something MANUALLY ON THE BITS? You're all still searching in wallets and seeds.

So to summarize — I have thousands of considerations in my book. I planned to publish it once I had the full solution — but if I publish the solution, someone scoops the entire reward. In 2015 the prize was a nice gesture, but today it's serious money and millions of people are circling. I expect that if I share my two years of 10-hour-a-day research, someone will find something, finish the puzzle, and take everything. So out of respect for the creator, I won't reveal too much. Think for yourselves: is this brute force, or a clever logical puzzle? Did the creator make one isolated key per output, or does EVERY SOLVED KEY CONTAIN DATA needed for the next one?

Thank you for any kind feedback. I hope you'll see this puzzle a little differently now — as something mathematically wonderful and logical, not as something someone built to find out how much you'd spend on GPUs.

Greetings, saatoshi_rising — nice nickname

8_2bp

[mcdouglasx]

snip¨-

The creator says this is a brute-force measurement tool, created with an HD Wallet where private keys were transformed into keys ranging from 1 to 256 bits. He didn't have to search for random private keys; you can do this with a simple Python script. Regarding the fact that he didn't take into account Ripemd160, the creator himself admitted that he didn't give it much thought. Later, he improved his measurement tool by making it more appealing, exposing the public keys of every fifth key. This reinforces his argument that it's a measurement tool, since with a high percentage of keys discovered, the pattern would have been visible, and the only pattern is that each key increases its difficulty exponentially by 1 bit at a time.

I am the creator.

You are quite right, 161-256 are silly.  I honestly just did not think of this.  What is especially embarrassing, is this did not occur to me once, in two years.  By way of excuse, I was not really thinking much about the puzzle at all.

I will make up for two years of stupidity.  I will spend from 161-256 to the unsolved parts, as you suggest.  In addition, I intend to add further funds.  My aim is to boost the density by a factor of 10, from 0.001*length(key) to 0.01*length(key).  Probably in the next few weeks.  At any rate, when I next have an extended period of quiet and calm, to construct the new transaction carefully.

A few words about the puzzle.  There is no pattern.  It is just consecutive keys from a deterministic wallet (masked with leading 000...0001 to set difficulty).  It is simply a crude measuring instrument, of the cracking strength of the community.

Finally, I wish to express appreciation of the efforts of all developers of new cracking tools and technology.  The "large bitcoin collider" is especially innovative and interesting!

[skedarve]

I managed to lower the complexity of #135 from 67.5 to 57.5 bits. I've already tested my method and it works perfectly. Now I'm waiting on vast.ia; I hope I get lucky or succeed as soon as possible.