You only know the address, so each candidate key needs a full elliptic-curve multiplication plus two hashes. GPU tools such as BitCrack, KeyHunt-Cuda and VanitySearch-style kernels do this at a few hundred million to a few billion keys per second per card. Puzzle 71 needs on average 2^69 tests, about 590 quintillion. At one billion keys per second that is around 18,700 years for one card.

A randomized block sweep visits every block once in a seeded order, so it avoids repeats within your run and can resume exactly. It does not change the expected time, and separate browsers can still overlap unless they coordinate their ranges.

When the public key is known the problem becomes a discrete logarithm in a bounded interval. Kangaroo (JeanLucPons’ CUDA implementation is the standard) solves an N-bit interval in about 2·√(2^N) group operations. Puzzle 140 needs on the order of 2^71 operations, which is why #130 fell in 2024 to a large GPU pool and #135 fell in July 2026. Puzzle 140 is the current frontier; expect it to take a cluster, not a desktop.

Pools split the interval among contributors and share the reward. Solo or pooled, the dangerous moment is the spend. When your sweep transaction hits the mempool, the public key is revealed, and for puzzles below about 2^125 a well-provisioned bot can derive the private key and replace your transaction with a higher fee before it confirms. Solvers of #66 lost exactly this race in 2024. Broadcast through a private relay or a miner-direct channel, and use a high fee.

JeanLucPons / Kangaroo ↗ · albertobsd / keyhunt ↗ · brichard19 / BitCrack ↗ · privatekeys.pw puzzle tracker ↗ · BitcoinTalk thread ↗

A transaction broadcast on 15 January 2015 that funded 256 addresses with 32.896 BTC in total. The private key for puzzle N was chosen from the interval [2^(N−1), 2^N), so each puzzle is exactly one bit harder than the last. The creator later retired puzzles 161 to 256, leaving 160 that can be solved.

77 puzzles, #71 through #160, remain unsolved. Together they hold about 903 BTC. The most recent solve was puzzle #135 on 28 July 2026.

Each unsolved puzzle N holds roughly N/100 BTC after the creator's top-ups: #71 holds 7.1 BTC, #101 holds 10.1 BTC, #160 holds 16 BTC. Solved puzzles hold nothing. The unsolved pool is 903.01667813 BTC; the USD figure at the top of this page is computed from a live price.

Puzzle #71 is the cheapest unsolved puzzle. Its address is 1PWo3JeB9jrGwfHDNpdGK54CRas7fsVzXU, its private key lies between 2^70 and 2^71, and it holds 7.1 BTC. Only the address is known, so it needs brute force over about 1.18 sextillion keys.

Enumerate private keys in the puzzle's interval, derive each compressed public key on secp256k1, hash it with SHA-256 then RIPEMD-160, and compare with the address. Puzzles whose public key was revealed (#140, #145, #150, #155, #160) can instead be attacked with Pollard's kangaroo, which needs roughly the square root of the work. The web cracker on this site runs the brute-force method in your browser.

The "1000 BTC" figure is a myth. The original transaction distributed 32.896 BTC. Later top-ups by the creator raised the per-puzzle prizes to N/100 BTC, and a 2023 deposit added 872.2 BTC across the unsolved addresses, which is where the larger totals come from.

Unknown. The pseudonymous BitcoinTalk account saatoshi_rising demonstrated control of the puzzle keys in 2017 and is the strongest claimant, but no real-world identity has been established. The case file on this site traces the evidence.

#135 fell on 28 July 2026, #69 on 30 April 2025, #68 on 6 April 2025, #67 on 21 February 2025, #130 on 23 September 2024 and #66 on 12 September 2024. The ledger lists every solve date.