I am laughing at how the thread became, a lot of trolling and it ressembles a d*** measuring contest. Is anyone ever going to bring forth some serious theories instead of posting that they found something without ever telling what it was? It's giving too much cold war vibes (ya know, when everyone used to "fake" and indirectly threaten the enemy by pretending to be on the moon or whatever lol).
So far, I liked zahid888's theory, detailed and with some examples. I would have loved to see everyone contribute their findings, rather than just come here posting stressing us all out that a weirdo may unlock all those keys (plz donate if you do
)
secp256k1. an analysis anyone can check
every claim was proven from raw chain data or from the curve arithmetic itself, or is in the one clearly labelled section of published theorems.
1. the curve
bitcoin signs with
y^2 = x^3 + 7 mod p
p = 2^256 - 2^32 - 977
the group order n is prime:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
the generator:
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
2. the structure checks
every check here is mechanical. the constants are given in full so anyone can run them.
2.1 G lies on the curve. substitute Gx and Gy into y^2 = x^3 + 7 mod p. holds.
2.2 the 2G control. 2G is widely published:
2Gx = 0xC6047F9441ED7D6D3045406E95C07CD85C778E4B8CEF3CA7ABAC09B95C709EE5
2Gy = 0x1AE168FEA63DC339A3C58419466CEAEEF7F632653266D0E1236431A950CFE52A
recomputing 2G from G with any correct group law implementation must land on exactly this point. this is the control that catches broken code.
2.3 the order. n times G is the point at infinity, and n passes 24 rounds of miller rabin. n is prime and G is not the identity, so the order of G is exactly n.
2.4 the full group order. hase's bound says the trace t = p + 1 - #E satisfies |t| <= 2 sqrt(p). here t = p + 1 - n = 432420386565659656852420866390673177327, inside the bound. n lies in the hase interval and 2n does not, so the only multiple of n in the interval is n itself. the number of points on the curve is exactly n, and the cofactor h = 1. this follows from 2.3 alone, it is not a quoted fact. an extra confirmation: n times each of five random points is the point at infinity, which is exactly what a full group of order n predicts.
2.5 the group law. associativity and inverse spot checks hold on random scalars.
2.6 the endomorphism. secp256k1 has j = 0, so it carries the extra structure most curves do not have. two constants:
lambda = 0x5363AD4CC05C30E0A5261C028812645A122E22EA20816678DF02967C1B23BD72
beta = 0x7AE96A2B657C07106E64479EAC3434E99CF0497512F58995C1396C28719501EE
lambda^2 + lambda + 1 = 0 mod n. beta^2 + beta + 1 = 0 mod p. lambda times G equals (beta Gx, Gy), and the same holds on random points. this is the glv split that fast implementations use.
beta is derivable, not memorized. p = 3 mod 4, so sqrt(-3) mod p = (-3)^((p+1)/4), and the cube roots of unity are (-1 +/- sqrt(-3))/2. both roots pass the identity check, the generator check picks the right one. anyone can recompute beta from scratch this way and get the value above. two further confirmations: beta cubed is 1 mod p and beta is not 1 itself, so beta is a genuine cube root of unity. and the identity lambda times P equals (beta x, y) holds on a random point, not only on the generator.
2.7 the twist. the quadratic twist has order 2p + 2 - n, which factors as
3^2 * 13^2 * 3319 * 22639 * R
where R passes 12 rounds of miller rabin. the cofactor is 114286177161 and the rest is a giant probable prime. attacks that need small twist cofactors are dead. the twist order was computed two independent ways, 2p + 2 - n and p + 1 + t, and the two agree.
2.8 the embedding degree. the mov and frey ruck attacks need n to divide p^k - 1 for small k. such a k must divide n - 1. here
n - 1 = 2^6 * 3 * 149 * 631 * C
where C = 6414488540731361226607730496888035255996436684289152125202372832747357 is composite with no prime factor below 10^6. the union of every k from 1 to 200 and every divisor of n - 1 built from the small factors, 241 values in total, was tested. none satisfies p^k = 1 mod n. any valid k is therefore at least 10^6. a pairing into a field of extension degree a million is not an attack. this is a proven bound, not the exact embedding degree.
2.9 the costs. pollard rho costs sqrt(pi n / 2) = about 2^128.3 group operations. baby step giant step needs 2^128 memory. pollard kangaroo is expected to cost about 2 sqrt(W) for a range of width W.
3. attacks that do not apply
the ones proven dead by the checks above:
smart's anomalous curve attack. needs the group order to equal p. section 2.4 proved the order is n, not p.
mov and frey ruck. need a small embedding degree. the bound in 2.8 closes them.
invalid curve and twist attacks. the curve has cofactor 1 and the twist's cofactor is the giant prime product in 2.7. points that do not satisfy y^2 = x^3 + 7 must be rejected before any scalar multiplication, and then nothing is left for these attacks.
the ones listed for completeness, published theorems with published proofs, not re-derived here:
index calculus. no subexponential algorithm exists for generic elliptic curves over prime fields.
weil descent and the ghs family. these need composite extension fields. this curve is over a prime field.
4. the attacks that work. implementation attacks on ecdsa
an ecdsa signature is (r, s) with
s = k^-1 (z + r d) mod n
where z is the message hash, d the private key, k the nonce. the curve itself is sound. every practical break is an implementation break.
nonce reuse. pure algebra
two signatures with the same k:
k = (z1 - z2) (s1 - s2)^-1 mod n
d = r^-1 (s k - z) mod n
both lines follow directly from the signature equation by subtraction. any wallet that ever repeated a nonce was drained. as a check of the algebra itself: a signature was built from the equation with a known key and nonce, and the two recovery lines returned the exact key and the exact nonce. the equations work in both directions.
biased nonces. found on chain, re-verified from raw data
two deterministic nonce formulas were found in real bitcoin signatures:
formula A: k = (z >> 128) << 128
formula B: k = n - ((z >> 128) << 128)
the nonce is the message hash with its bottom 128 bits zeroed, or n minus that. one family, two signs.
the odds. a random nonce having its bottom 128 bits all zero is 2^-128 per signature. seeing the pattern at all is not chance.
the proof, self-contained. for each of the four signatures below: take the raw transaction from the chain, compute the sighash z, recover r and s, assume the formula k, compute
d = r^-1 (s k - z) mod n
and derive the public key from d. the public key must equal the public key pushed in the signature. no key list involved. all four pass:
tx f4cac758926977b6d4970c5f59d1f59589ae6400c6a2318fef1c476bf32c5089 (2016-04-09) formula A recovered d = 7
tx bd4051685a68576e09a652980e3cd076443bff10bee52d46dc08227f8df49185 (2017-09-30) formula B recovered d = 21
tx 4fd371b373c8f27a96d88c846d81d3b6d98adb4b964ae0b719a0d3a2d792a6b3 (2017-10-31) formula A recovered d = 8
tx 4b553150b8c8789cb68059f3dab3862987e9982a0b24472450d641aff5aea3c1 (2017-11-15) formula B recovered d = 7
7, 21 and 8 are the published private keys of puzzle 3, puzzle 5 and puzzle 4. the signatures that spend those addresses were made with nonces generated by the two formulas. the key record was cross checked against two independent sources, the puzzle listing and the solved keys table, and all three agree. and in each of the four transactions the spent output's script commits to the same public key that the signature pushes, so the signature, the script, and the recovered key all point the same way.
the control that the method is sound. each of the four signatures also verifies normally against its pushed public key. a wrong sighash computation would fail verification, so the z values are proven correct before any formula is tried.
one full example. the first signature:
z = 0x9190c9b03e94af91480227eeb9c7378a1ade4d86d0e2bea19502c19bb014ddb1
k = 0x9190c9b03e94af91480227eeb9c7378a00000000000000000000000000000000
the top half of k is the top half of z, byte for byte, and the bottom 128 bits are zero. formula B's signature has k's bottom 128 bits equal to n's bottom 128 bits, 0xbaaedce6af48a03bbfd25e8cd0364141, byte for byte.
the honest limits. why the tool was built this way is unknown. no attribution is made and none should be inferred from the arithmetic. this report claims exactly these four signatures and nothing beyond them.
the standing requirement
proper implementations derive k deterministically from the key and the message, rfc6979, or from a good random source. every one of the breaks above came from a wallet that did neither.
5. measured kangaroo behaviour
a fresh pollard kangaroo was written and run on this machine on 2026-08-20, standard python, one core. jump table of 102 hash derived values, mean sqrt(W)/2, distinguished points are x coordinates with the low 8 bits zero, tame starts at the upper bound, wild at the public key. five known keys:
p24: 4216 steps, K = 0.73
p28: 11090 steps, K = 0.48
p32: 72312 steps, K = 0.78
p36: 706589 steps, K = 1.91
p40: 280775 steps, K = 0.19
K = steps / (2 sqrt(W)), the standard normalization. K wobbles 0.19 to 1.91 run to run. single run noise, not signal. the walk is fully deterministic, and rerunning it reproduces the exact step counts above.
the measured rate. 7200 point additions per second, one core, pure python, on the machine this was run on. faster machines change the constant, not the exponent.
the wall, stated with the measured numbers. puzzle 140's range is [2^139, 2^140). kangaroo cost is about 2 sqrt(2^139) = 2^70.5 point additions = about 1.67e21 additions. at this machine's 7200 additions per second that is 2.3e17 seconds, about 7.4e9 years on one core. p140 is a fleet problem or a structure problem. it is not a one machine problem.
what this means for the puzzles
puzzle 71. an address commits ripemd160(sha256(pubkey)). reversing that is a 160 bit preimage problem, and elliptic curve cryptanalysis does not reach it. the key comes from a spend or from the key itself.
puzzle 140. the public key is on chain from a 2019 spend. confirmation: input 15 of that transaction pushes a public key, and the ripemd160 hash of that public key is exactly the published puzzle 140 target address. the attack is the kangaroo, and the wall is 2^70.5 point additions, measured above.
the curve checks in section 2 confirm the curve is exactly what its security assumes. the breaks in section 4 are wallet breaks.
how to check this yourself
one. take the constants from section 1 and a correct group law implementation. check G on curve, 2G, nG = infinity.
two. verify the hase argument: t = p + 1 - n is inside 2 sqrt(p), and n is the only multiple of itself in the hase interval.
three. derive beta as in 2.6 and check both identities and the generator relation.
four. trial divide 2p + 2 - n by small primes and miller rabin the remainder.
five. build the divisor set of n - 1 from 2, 3, 149, 631 and check p^k mod n for each.
six. for the nonce finding, fetch the four transactions, compute z from the sighash, verify each signature against its pushed public key, then assume each formula k and derive d = r^-1 (s k - z) mod n. the derived public keys match the pushed public keys. the recovered keys are 7, 21, 8, 7.
