The Bitcoin Puzzle (1000 BTC Challenge) — Everything I Found After 1 Year of Digging

By gamedeveloper8136 | Full Bitcoin | 17 hours ago

July 2026

So there's this thing called the Bitcoin Puzzle, also known as the 1000 BTC Challenge. It's basically the biggest cryptographic treasure hunt Bitcoin has ever seen. Right now there's about 900+ BTC (~$60M+) sitting in addresses that nobody has cracked yet.

I've spent the last year+ obsessing over this thing. Tracing transactions, staring at hex dumps, running scripts that go nowhere, and slowly piecing together how it all works. This is everything I've found — from the basic math up to the stuff that still keeps me up at night.

How Bitcoin Security Actually Works (The Simple Version)

Every Bitcoin address is backed by a private key — a really big random number (256 bits). From that number you can compute a public key (elliptic curve math, one direction, easy). From the public key you hash it to get an address.

The whole security model relies on one thing: going backwards is impossibly hard.

Private key → Public key? Easy. Takes a millisecond.
Public key → Private key? That's the Elliptic Curve Discrete Logarithm Problem (ECDLP). With today's computers, you'd need longer than the universe has existed.

The curve Bitcoin uses is secp256k1:

y² = x³ + 7

That's it. That simple equation secures the entire network.

How the Puzzle Started

Back on January 15, 2015, someone anonymous on BitcoinTalk (they went by "zielar") created a transaction that sent Bitcoin to 256 different addresses. The amounts were small but followed a pattern:

Puzzle #1 → 0.001 BTC (private key somewhere between 1 and 1 — yep, just the number 1)
Puzzle #2 → 0.002 BTC (key between 2 and 3)
Puzzle #66 → 0.066 BTC (key between 2⁶⁵ and 2⁶⁶-1)
Puzzle #160 → 0.160 BTC (key between 2¹⁵⁹ and 2¹⁶⁰-1)

Total initial funding: about 33 BTC.

The creator said something that I've been staring at for months:

"It is just consecutive keys from a deterministic wallet (masked with leading 000...0001 to set difficulty). It is simply a crude measuring instrument, of the cracking strength of the community."

A "measuring instrument." He wanted to see how fast the community could crack different key sizes.

The Timeline of Events That Matter

2015 — People Start Cracking

The first 50 puzzles fell in the first weeks and months. These were small key ranges — some were literally just the number 1, 2, 3, etc. Not exactly hard.

May 31, 2019 — The Public Key Leak

This is where things get interesting. The creator sent 1000-satoshi transactions from every 5th puzzle address — #65, #70, #75, all the way up to #160.

Why this matters: Before you spend from a Bitcoin address, nobody can see your public key — only the hash (the address). Once you spend, the public key goes on the blockchain forever.

The creator essentially gave us the public keys for 20 puzzles. This changed the game completely:

Before the leak: You could only brute-force (try every private key until one matches the address hash) — complexity O(2^N)
After the leak: You can use Pollard's Kangaroo algorithm — complexity O(2^(N/2))

Kangaroo is exponentially faster. A puzzle that would take trillions of years to brute-force becomes merely "incredibly hard" with Kangaroo.

April 2023 — The Mega Refill

The creator dropped a bombshell. Every unsolved puzzle's prize got bumped by about 10x. Total pool: ~1,000 BTC. At today's prices that's over $60 million.

2024-2025 — The Big Solves

This is where things got chaotic:

Puzzle #66 (September 2024) — 6.6 BTC
Someone solved it. They immediately tried to claim the prize by broadcasting a transaction to the public mempool.

Big mistake.

Bots were watching. They saw the transaction, extracted the public key, ran Kangaroo (the private key range was known — 66 bits), found the private key within seconds, and broadcasted their OWN transaction with higher fees.

The original solver got nothing. The prize was stolen by bots.

The same thing happened with Puzzle #69 (April 2025). The solver found it at literally 0.72% into the search range — incredibly early luck. Broadcast to public mempool. Stolen again.

Puzzle #67 (February 2025) — This solver learned from #66. They used MARA Slipstream, a private mining service that submits transactions directly to a mining pool, bypassing the public mempool entirely. They claimed the full 6.7 BTC.

Puzzle #68 — Same method. Also solved successfully.

Current State: July 2026

82 out of 160 puzzles have been solved. ~900+ BTC still waiting.

Solved: #1 through #70 (all sequential), plus every 5th key up to #130 (#75, #80, #85, #90, #95, #100, #105, #110, #115, #120, #125, #130)

The Funding Chain — Tracing the Creator

I traced the original funding transaction backwards to find where the BTC came from. This matters because of the BIP32 thing I'll explain next.

The origin TXID:

08389f34c98c606322740c0be6a7125d9860bb8d5cb182c02f98461e5fa6cd15

Following the inputs, I found two interesting funders:

Funder #1 — A Ghost from 2010

This address uses P2PK (Pay-to-Public-Key) format with an uncompressed public key. That's ancient — people stopped using uncompressed keys around 2011-2012. The public key has been visible on-chain since day one.

This person is either:

An OG miner from 2009-2010
Someone who was around when Satoshi was still posting
Someone who never bothered to move their coins (until the puzzle)

Funder #2 — The 872 BTC Whale

02 c584e2cb49a5aabd9ceb1e5128cecd0a7ca96628e76b1491950f021a4852d8ec

This address sent ~872 BTC to the puzzle in a single transaction. Compressed public key — more modern, but still old money.

I'm fairly certain this is the puzzle creator themselves. They consolidated a massive holding and funded the challenge from one wallet.

The BIP32 Hypothesis — Why It Matters

This is the part that gets me excited.

The creator said the keys come from a "deterministic wallet." In Bitcoin, the standard for deterministic wallets is BIP32 — Hierarchical Deterministic wallets.

Here's how BIP32 works in simple terms:

You have one master private key (derived from a seed phrase). From that, you can derive a whole tree of child keys, grandchildren, etc.

For non-hardened derivation (a specific type), there's a critical math relationship:

k_child = k_parent + some_value (mod n)

Which means:

k_parent = k_child - some_value (mod n)

If I have one child private key (say, from a solved puzzle), the parent public key (from the funding chain), and the chain code... I can recover the master private key.

And once I have the master key, I can derive ALL 160 puzzle keys. Instantly. No brute-force, no Kangaroo, no waiting.

The Problem: The Missing Chain Code

The chain code is like a secret ingredient that goes into the HMAC calculation. Without it, I can't compute the "some_value" in the equation above.

I've tried:

All zeros (nope)
SHA-256 of the TXID (nope)
SHA-256 of various strings related to the puzzle (nope)
The funding public key itself (nope)

Still searching.

The Masking Problem

There's another issue. The creator said keys are "masked with leading zeros." This means:

The full BIP32 key is 256 bits. The creator then took only the lower N bits (for puzzle #N) and zeroed out the rest.

So the key we see for puzzle #66 is only the lower 66 bits of the real BIP32 key. The upper 190 bits are lost.

This means even if I find the chain code, I'd only recover the lower N bits of the master private key. The upper bits are unknown. I'd need to brute-force them — but at ~190 bits for puzzle #66, that's still impossible.

Unless... the creator used a different masking scheme. Or the "masking" is something simpler than what I'm assuming. Still working on this.

Attack Vectors: What Works for What

Here's the current state of the art for cracking puzzles:

Method Works For Speed Brute-force (BitCrack) Puzzles WITHOUT exposed public keys (#71, #72, etc.) O(2^N) — slow Pollard's Kangaroo Puzzles WITH exposed public keys (#135, #140, etc.) O(2^(N/2)) — much faster BIP32 Reversal ALL puzzles IF the chain code is found Instant — O(1)

Reality check with a single RTX 4090:

Puzzle #70 Kangaroo: seconds
Puzzle #80 Kangaroo: hours to days
Puzzle #135 Kangaroo: literally millennia
Puzzle #160 Kangaroo: not in this universe

Beyond about ~130 bits, even Kangaroo is hopeless with today's hardware. That's why the BIP32 approach is the only realistic path to solving the high-number puzzles.

The Mempool Problem

If you ever solve a puzzle — DO NOT broadcast through the public mempool.

What happens:

You broadcast your claim transaction
Bots monitoring the mempool see it
They extract the public key from your transaction input
They know the puzzle range (it's public)
They run Kangaroo — finds the private key in seconds to minutes
They rebroadcast with higher fees
Your transaction never confirms
The prize goes to the bot

Solution: Use a private mining service. MARA Slipstream, Antpool private mining, or similar. They submit directly to the block template — nobody sees it until it's confirmed.

What's Next

Next Targets

Puzzle #71 (7.1 BTC) — Easiest remaining unsolved brute-force puzzle. Distributed GPU pools are likely already scanning. Expect a solve soon.

Puzzle #135 (13.5 BTC) — Public key is exposed. Kangaroo pool actively targeting. This is the highest-value exposed-key puzzle.

Puzzle #140, #145, #150, #155, #160 — All have exposed public keys but are in ranges where even Kangaroo takes forever with current hardware.

The Quantum Question

This puzzle is what people call a "quantum canary."

If Puzzle #135 suddenly gets solved way faster than expected (theoretical minimum is ~2⁶⁷ Kangaroo jumps = millennia on current hardware), it means someone has either:

A revolutionary new algorithm
Access to serious quantum hardware

If Puzzle #160 gets solved — 2⁸⁰ Kangaroo jumps, physically impossible with current tech — then Bitcoin's ECDSA security is effectively broken.

That's the real purpose of this puzzle. It's an early warning system.

What I'm Still Trying to Figure Out

The chain code. This is THE missing piece. If I find it, everything else falls into place.
The masking. Exactly how did the creator "mask" the keys? Was it simple bitwise AND? Or something else?
Who is zielar? OG miner from 2010, held 1000+ BTC, speaks English with possible European origin. But that's all I've got.
The derivation path. Even with the right chain code, I need to know the exact BIP32 path (m/44'/0'/0'/0/i? m/0/i? Something custom?)