INVESTIGATIVE DOSSIER · RESEARCHED 03 OCT 2026
@lamps_apple
THE 2015 BITCOIN PUZZLE TRANSACTION

The Bitcoin Puzzle.
160 locks, one doubling key.

The Bitcoin Puzzle Transaction (sometimes called the 32 BTC puzzle or the 1000 BTC puzzle) began on 15 January 2015 when someone funded 256 addresses whose private keys sit in ever-larger ranges: puzzle N hides inside [2^(N−1), 2^N). Solvers have cracked the easy end. The hard end is still paying.

—

puzzles genuinely solved so far, out of 160 that can be solved

—

puzzles still open, #71 up to #160, all funded

—

most recent solve

—

cheapest unsolved puzzle, next in line

01

How the puzzle works

One transaction, 256 outputs, a private key per output that lives in a known interval.

Every puzzle is an ordinary pay-to-pubkey-hash address. What makes it a puzzle is that the private key for puzzle N was chosen from a tiny slice of the 256-bit keyspace: an integer between 2^(N−1) and 2^N − 1. Puzzle 1 has a single candidate. Puzzle 20 has about half a million. Puzzle 71, the cheapest still unsolved, has 1.18 sextillion.

01 · PICK A PUZZLE

Choose a puzzle number N. Its address and key range are fixed and public. The ledger lists all of them.

02 · ENUMERATE KEYS

Walk the integers in [2^(N−1), 2^N). For each one, multiply the secp256k1 generator by it to get a public key.

03 · HASH AND COMPARE

SHA-256 then RIPEMD-160 the compressed public key. If the 20-byte result equals the address’s hash, you hold the key.

04 · SWEEP THE PRIZE

Import the key into a wallet and move the coins. Do it fast: bots watch the mempool for exactly these spends.

The creator later topped the prizes up to N/100 BTC per puzzle, swept puzzles 161 to 256 back in 2017, and in 2019 revealed the public keys of every fifth puzzle from 65 to 160. Those public-key puzzles can be attacked with Pollard’s kangaroo, which needs roughly the square root of the work of a blind search. Full background on who did this and why is in the case file.

02

How to attempt it

What serious solvers actually run, and what each approach costs.

There is no trick. Every solve so far has been raw computation, so the question is only how many keys per second you can test and how lucky you are.

Address-only puzzles: brute force#71–#160 except every fifth

You only know the address, so each candidate key needs a full elliptic-curve multiplication plus two hashes. GPU tools such as BitCrack, KeyHunt-Cuda and VanitySearch-style kernels do this at a few hundred million to a few billion keys per second per card. Puzzle 71 needs on average 2^69 tests, about 590 quintillion. At one billion keys per second that is around 18,700 years for one card.

A randomized block sweep visits every block once in a seeded order, so it avoids repeats within your run and can resume exactly. It does not change the expected time, and separate browsers can still overlap unless they coordinate their ranges.

Public-key puzzles: Pollard’s kangaroo#140, #145, #150, #155, #160

When the public key is known the problem becomes a discrete logarithm in a bounded interval. Kangaroo (JeanLucPons’ CUDA implementation is the standard) solves an N-bit interval in about 2·√(2^N) group operations. Puzzle 140 needs on the order of 2^71 operations, which is why #130 fell in 2024 to a large GPU pool and #135 fell in July 2026. Puzzle 140 is the current frontier; expect it to take a cluster, not a desktop.

Pools and the front-running problemWhy a found key is not yet a prize

Pools split the interval among contributors and share the reward. Solo or pooled, the dangerous moment is the spend. When your sweep transaction hits the mempool, the public key is revealed, and for puzzles below about 2^125 a well-provisioned bot can derive the private key and replace your transaction with a higher fee before it confirms. Solvers of #66 lost exactly this race in 2024. Broadcast through a private relay or a miner-direct channel, and use a high fee.

Tools and referencesWhere to start

JeanLucPons / Kangaroo ↗ · albertobsd / keyhunt ↗ · brichard19 / BitCrack ↗ · privatekeys.pw puzzle tracker ↗ · BitcoinTalk thread ↗

03

The odds

What the remaining puzzles actually cost to crack.

Each step up doubles the work. The table shows the expected number of key tests for the next few unsolved puzzles and the time at a billion tests per second, which is a realistic single high-end GPU rate for address-only search.

Every unsolved puzzle has a page with its address, key range and prize: #71 #72 #73 #74 #76 #77 #78 #79 #81 #82 #83 #84 #86 #87 #88 #89 #91 #92 #93 #94 #96 #97 #98 #99 #101 #102 #103 #104 #106 #107 #108 #109 #111 #112 #113 #114 #116 #117 #118 #119 #121 #122 #123 #124 #126 #127 #128 #129 #131 #132 #133 #134 #136 #137 #138 #139 #140 #141 #142 #143 #144 #145 #146 #147 #148 #149 #150 #151 #152 #153 #154 #155 #156 #157 #158 #159 #160

Puzzle 71 is within reach of a dedicated farm over years, or a very large pool over months. Puzzle 100 and above are beyond any brute force at today’s hardware. The public-key puzzles are a separate race: #140 is roughly a thousand times harder than #130 was, and #130 took a GPU pool most of a year.

04

Try it yourself

A real brute-force engine that runs in your browser. Nothing leaves your device.

The web cracker derives public keys with its own secp256k1 implementation, hashes them in worker threads, and compares against the target address. On an already-solved puzzle it finds the real private key within seconds, which is how you can tell it is not a toy. On an open puzzle it is honest about the odds.

VERIFY THE ENGINEPuzzle #20 · solved 2015

Finds the real key in about a second.

 CHEAPEST OPEN PUZZLEPuzzle #71 · 7.1 BTC

Start where the money is and see the odds.

 KANGAROO FRONTIERPuzzle #140 · public key known

Brute force here is hopeless; the tab explains why.

Open the web cracker

05

Bitcoin puzzle FAQ

Short answers to what people search for.

What is the Bitcoin Puzzle Transaction?

A transaction broadcast on 15 January 2015 that funded 256 addresses with 32.896 BTC in total. The private key for puzzle N was chosen from the interval [2^(N−1), 2^N), so each puzzle is exactly one bit harder than the last. The creator later retired puzzles 161 to 256, leaving 160 that can be solved.

How many Bitcoin puzzles are still unsolved?

77 puzzles, #71 through #160, remain unsolved. Together they hold about 903 BTC. The most recent solve was puzzle #135 on 28 July 2026.

How much is the Bitcoin puzzle worth?

Each unsolved puzzle N holds roughly N/100 BTC after the creator's top-ups: #71 holds 7.1 BTC, #101 holds 10.1 BTC, #160 holds 16 BTC. Solved puzzles hold nothing. The unsolved pool is 903.01667813 BTC; the USD figure at the top of this page is computed from a live price.

What is Bitcoin puzzle 71?

Puzzle #71 is the cheapest unsolved puzzle. Its address is 1PWo3JeB9jrGwfHDNpdGK54CRas7fsVzXU, its private key lies between 2^70 and 2^71, and it holds 7.1 BTC. Only the address is known, so it needs brute force over about 1.18 sextillion keys.

How do you attempt a Bitcoin puzzle?

Enumerate private keys in the puzzle's interval, derive each compressed public key on secp256k1, hash it with SHA-256 then RIPEMD-160, and compare with the address. Puzzles whose public key was revealed (#140, #145, #150, #155, #160) can instead be attacked with Pollard's kangaroo, which needs roughly the square root of the work. The web cracker on this site runs the brute-force method in your browser.

Was the 1000 BTC Bitcoin puzzle real?

The "1000 BTC" figure is a myth. The original transaction distributed 32.896 BTC. Later top-ups by the creator raised the per-puzzle prizes to N/100 BTC, and a 2023 deposit added 872.2 BTC across the unsolved addresses, which is where the larger totals come from.

Who created the Bitcoin puzzle?

Unknown. The pseudonymous BitcoinTalk account saatoshi_rising demonstrated control of the puzzle keys in 2017 and is the strongest claimant, but no real-world identity has been established. The case file on this site traces the evidence.

Which Bitcoin puzzles have been solved recently?

#135 fell on 28 July 2026, #69 on 30 April 2025, #68 on 6 April 2025, #67 on 21 February 2025, #130 on 23 September 2024 and #66 on 12 September 2024. The ledger lists every solve date.

The creator is still unknown.

But one pseudonymous account is tied to the puzzle by something stronger than a forum claim: control of the private keys. The public trail points to an early Bitcoin whale and stops there.

256

outputs in the original January 2015 transaction

32.896

BTC originally distributed — not roughly 1,000 BTC

1

post ever attributed to the strongest creator claimant

11 wk

from the claimant’s promise to the matching on-chain spend

01 / PREMISE CHECK

Three facts change the case

What the primary record says before identity theories enter.

The familiar version of the story begins with a user called “Someone,” a thousand-bitcoin giveaway, and a January 15 announcement. None of those three details survives the source check.

1

“Someone” was a mistranslation, not an account

The Russian OP wrote кто-то — “someone” or “somebody” — about whoever launched the transaction. The actual poster was amaclin, who immediately wrote “it wasn’t me.” Verified

2

The first distribution was 32.896 BTC

The transaction spent one 32.9 BTC input into 256 outputs worth 0.001 × N BTC, with a 0.004 BTC fee. The roughly 1,000 BTC figure reflects later 2017 and 2023 additions. Verified

3

The announcement appeared January 23

The funding transaction confirmed January 15, 2015. The earliest public discussion found was the Russian-language Bitcointalk thread posted eight days later. Verified

02 / THE ANNOUNCEMENT

A discovery, not a confession

Bitcointalk topic 932434 · Russian local board

Legendary member amaclin posted “Забавная транзакция (Ханойские башни)” — “Funny transaction (Towers of Hanoi)” — at 07:43:22 forum time on January 23, 2015.

“Забавную транзакцию кто-то запузырил в сеть недавно … Сразу скажу — не я.”

“Somebody recently launched a funny transaction into the network … I’ll say right away — it wasn’t me.”

The thread supplied no creator biography, motive, or formal rules. Amaclin inferred the mechanism from the chain: output N appeared to use a private key in [2^(N−1), 2^N), making each next solution require roughly twice the computation. He published cracked keys 1–24 and cautioned that his own explanation was only a supposition.

What amaclin actually inferred

He described 256 outputs from 0.001 to 0.256 BTC, “clever” randomness, a key range doubling with each output, and a reward that increased without doubling. The “Towers of Hanoi” title and chessboard/rice-grain analogy framed the exponential search space. The thread received two replies on January 25 and then went quiet.

Why the English record starts much later

Bulista opened the English megathread on December 28, 2015 after finding the transaction “while playing around with my bot.” That thread — topic 1306983 ↗ — became the puzzle’s best-known public home. Bulista was a discoverer, not the creator.

03 / STRONGEST LEAD

The one-post claimant who could spend

A statement in April. A matching transaction in July.

On April 27, 2017, an account named saatoshi_rising made a single post: “I am the creator.” It described how the keys were made and promised to move outputs 161–256 into the unsolved lower ranges. Eleven weeks later, those exact outputs moved.

27 APR 2017

The claim

“I am the creator.” The account says there is no pattern and promises a redistribution.

11 WEEKS

The test

Only someone holding private keys 161–256 can execute the promised spend.

11 JUL 2017

The proof

All 96 outputs move on-chain into the lower unsolved puzzles.

Verified The post’s author controlled the puzzle keys. Likely The key holder was the original creator; a private transfer of the keys is possible in principle, but no evidence supports it.

“There is no pattern. It is just consecutive keys from a deterministic wallet (masked with leading 000...0001 to set difficulty). It is simply a crude measuring instrument, of the cracking strength of the community.”
Read the claimant’s full statement

“I am the creator.

You are quite right, 161-256 are silly. I honestly just did not think of this. What is especially embarrassing, is this did not occur to me once, in two years. By way of excuse, I was not really thinking much about the puzzle at all.

I will make up for two years of stupidity. I will spend from 161-256 to the unsolved parts, as you suggest. In addition, I intend to add further funds. My aim is to boost the density by a factor of 10, from 0.001*length(key) to 0.01*length(key). Probably in the next few weeks. At any rate, when I next have an extended period of quiet and calm, to construct the new transaction carefully.

A few words about the puzzle. There is no pattern. It is just consecutive keys from a deterministic wallet (masked with leading 000...0001 to set difficulty). It is simply a crude measuring instrument, of the cracking strength of the community.

Finally, I wish to express appreciation of the efforts of all developers of new cracking tools and technology. The ‘large bitcoin collider’ is especially innovative and interesting!”

Key control

saatoshi_rising

One known post. Calm, self-deprecating prose; double spaces after periods; no personal details. A signed forum message was never posted, but the later spend is stronger operational evidence.

Claimed
Original creator
Proved
Control of keys 161–256
Identity
Unknown
Not creator

amaclin

The first public analyst, not the funder. His profile described a Russian-board regular with 7,244 posts and only “at most 0.02 BTC” in crypto — a poor fit for the source whale.

Registered
Dec. 20, 2013
Last active
Sept. 29, 2018
Profile
Bitcointalk ↗
04 / MONEY TRAIL

An early-holder whale, still unnamed

Four transactions · blocks 339030–339085 · January 15, 2015

The 32.9 BTC puzzle input emerged from a same-day peel chain controlled by one wallet. The chain began with five inputs from an older uncompressed-key address and passed through a wallet later observed with 56,457.80848111 BTC of lifetime inflow.

BLOCK
339030
200 BTC

Old-key consolidation

Five inputs — 71, 54.9, 37, 30 and 27.90182308 BTC — from 13R2…WJW9, signed with an uncompressed public key; 200 BTC sent to 173u…cqT.

BLOCK
339043
194.99999

Compressed-key peel begins

The same compressed public key recurs through the next steps, tying the chain to one wallet. 13.12008 BTC leaves; 181.8799 BTC continues.

BLOCK
339045
32.9 BTC

Puzzle stake separated

Alongside 1.5 BTC, 2 BTC and a 100 BTC P2SH output, 32.9 BTC moves to 1Czoy8…Kh697F; 45.47989 BTC returns as change.

BLOCK
339085
32.896

The puzzle transaction

08389f34c98c606322740c0be6a7125d9860bb8d5cb182c02f98461e5fa6cd15 creates 256 outputs. Fee: 0.004 BTC.

Likely The pattern fits a personal early-holder wallet better than an exchange: single-key reuse, a peel chain, round-number consolidation, and an uncompressed-key predecessor. No source names the owner. No published WalletExplorer, oxt.me, blog, or forum attribution for this specific wallet was found.

05 / CONTACT RECORD

What the key holder did next

Two proven actions, one likely one — and no personal revelation.

After the original funding, the public record contains one forum statement and three major on-chain interventions. Only spending from puzzle addresses proves possession of their keys.

Original funding

256 outputs receive 0.001 × N BTC, totaling 32.896 BTC.

First public thread

amaclin spots the structure, denies authorship, and infers the key ranges.

One creator claim

saatoshi_rising describes the deterministic-wallet construction and promises a redistribution.

Promise executed Verified

Transaction 5d45587c…384164 spends outputs 161–256 and adds roughly 83.531 BTC to the lower unsolved puzzles.

Public keys revealed Verified

A dust-and-sweep operation spends 1,000-sat UTXOs from roughly 20 puzzle addresses, revealing their public keys. Only the key holder could sign the sweep.

872.2 BTC arrives Likely

A separate SegWit source adds 0.09 × N BTC to unsolved puzzles and sends 0.09 BTC to puzzle #1 as an apparent signal. The continuity strongly suggests the creator, but anyone could fund the public addresses.

06 / CLAIMS & THEORIES

What holds up — and what doesn’t

Evidence-ranked, not lore-ranked.

Early miner / whale

The source wallet’s scale and uncompressed-key predecessor support an early-holder profile. They do not identify a person.

Likely profile

Satoshi Nakamoto

The doubled “a” in saatoshi, double spaces, and “measuring instrument” language are wordplay and stylometry, not identity evidence.

Speculative

Polynomial key pattern

Fitted sequences and “2^n−1” theories overfit early solved keys. Key #4 equals 8, not 15; the key holder explicitly said there is no pattern.

Debunked

amaclin

He denied authorship in the first post, later described the author as unknown, and his own stated holdings conflict with the whale profile.

Not supported

Other “I am the creator” posts

Critical_Thoughts addressed the mystery rhetorically; albert0bsd joked about creating a software bug; Cricktor claimed to solve puzzle #66, not create the series.

Non-claims

A 2022 skeptic correctly argued that a bare forum claim proves nothing and asked for a signed message. No such forum signature appeared. But the July 2017 transaction answered the deeper question: the claimant could spend the puzzle outputs.

07 / OPEN QUESTIONS

Where the trail ends

Known gaps, preserved as gaps.

The research found no confirmed name, region, occupation, email, IP metadata, or personal history for the key holder. Timestamp and prose clues are too weak to narrow the field responsibly.

IDENTITY

Who controlled 173ujrh…cqT and its older uncompressed-key predecessor?

KEY CUSTODY

Was saatoshi_rising the original creator, or could the keys have transferred privately?

2023 FUNDER

Was the 872.2 BTC top-up made by the same person? The transaction fits, but cannot prove identity.

SIDE OUTPUTS

Where did the 100 BTC P2SH output and 45.47989 BTC change from the 2015 peel chain move afterward?

ACCOUNT METADATA

The claimant’s registration date, uid and nonpublic account metadata could not be verified because member search is login-gated.

SIGNED STATEMENT

No signed message, new puzzle, or later personal statement from the creator has surfaced.

08 / SOURCES

Primary record first

Links inspected on October 3, 2026. On-chain values were read from mempool.space API data.

The conclusion rests on public forum posts and on-chain spends. Secondary trackers supply indexing and context, not the identity verdict.

Proof of keys.
Not proof of name.

The strongest defensible conclusion is narrow: saatoshi_rising was controlled by the puzzle key holder in 2017, and the original funds came from an early-holder-scale wallet. Everything beyond that remains an open identity question.