The practical keyhunt guide

1. Installing

keyhunt is built with Linux in mind. On Windows, use WSL — a native build is a long slog. macOS works, but there is no GPU acceleration, so treat it as practice rather than production.

sudo apt update
sudo apt install -y git build-essential libssl-dev libgmp-dev

git clone https://github.com/albertobsd/keyhunt
cd keyhunt
make

# check the build
./keyhunt --help | head

libssl-dev and libgmp-dev are only needed for the legacy build, but installing them now saves you getting stuck later.

2. Can this tool be trusted?

Once it is installed, the thought arrives on its own. “This is a program that finds private keys. If I actually find one, what stops it quietly mailing the key somewhere?” That is a fair suspicion. A program that computes private keys is structurally in a position to steal them. And “it’s open source” is not an answer — open source that nobody reads is just code.

So it got checked. keyhunt is a C/C++ tool by albertobsd, and keyhunt.cpp is the body of the executable. Open that file and:

• There is not one networking header. sys/socket.h, netinet/in.h, curl/curl.h — none of them. The include list is stdio, stdlib, pthread and its own crypto library.
• There are no socket, connect or recv calls. Grep for anything resembling an address or a URL and the only hit is a comment on line 471, which turns out to be a link explaining random number generation.
• A found key is appended to KEYFOUNDKEYFOUND.txt. A local file.

Don’t take my word for it. From the repository root:

# (1) does the executable's own source include networking headers?
#     expected output: nothing
grep -nE '#include <(sys/socket|netinet/in|arpa/inet|curl/curl)' keyhunt.cpp

# (2) are there socket calls or URLs in it?
#     expected output: one comment on line 471 (a link about randomness)
grep -nE '\b(socket|connect|recv|getaddrinfo|curl)\b|https?://' keyhunt.cpp

# (3) which files anywhere in the repo include a networking header?
#     expected output: two — bsgsd.cpp and base58/base58.c
grep -rln 'sys/socket\.h\|netinet/in\.h\|arpa/inet\.h\|curl/curl\.h' .

# (4) does base58.c actually use any networking function?
#     expected output: nothing
grep -nE 'htonl|ntohl|socket' base58/base58.c

Check (3) returns two files. That is the most important part of this whole exercise, so here it is in full rather than glossed over:

• bsgsd.cpp — there are real sockets in it. But this is a server daemon that offers BSGS over the network, a separate program built for exactly that purpose and documented in BSGSD.md in the repo. What matters is that a plain make does not build it. You have to type make bsgsd on purpose. If you don’t, the program does not exist on your machine.
• base58/base58.c — includes arpa/inet.h and then uses nothing from it. It is leftover from Luke Dashjr’s libbase58 (MIT), which pulled it in for byte-order macros. Run grep -nE 'htonl|ntohl|socket' base58/base58.c and you get an empty result.

One more thing: the worry is aimed slightly off target. For keyhunt to steal your key, you first have to find something — and if you work out the odds, that does not happen. The real danger is not the tool. It is the moment you move the coins, which gets its own section below.

3. Picking a mode — most people get this wrong

keyhunt has several modes, and what you know about the target decides which one. Get it backwards and the program runs along happily without a word of complaint, finding nothing, forever. This is the most common way to waste time here.

If you want to know what BSGS and Kangaroo actually do?

For a sense of the gap: over a 71-bit range, an address brute force is 2⁷⁰ operations, while BSGS with a known public key is 2³⁵. A factor of 34 billion. That is why #140, #145, #150, #155, #160, whose public keys are exposed, are more realistic targets than much lower-numbered puzzles.

The command builder makes this call for you from the puzzle number alone.

4. Make your first run a solved puzzle

Start on an unsolved puzzle and you cannot even tell whether your tooling works. Run one whose answer is known first, and check that it finds it within seconds.

echo "1EeAxcprB2PpCnr34VfZdFrkUWuxyiNEFv" > 40.txt
./keyhunt -m address -f 40.txt -b 40 -l compress -t 8 -q -s 5

# KEY FOUND should appear within seconds.
# If it doesn't, the mode or the -b value is wrong.

-b 40 is the crucial part. It means “search the 40-bit range only”. Leave it out and it starts working through all 2²⁵⁶, which never ends.

5. Running a real target

echo "1PWo3JeB9jrGwfHDNpdGK54CRas7fsVzXU" > 71.txt
./keyhunt -m address -f 71.txt -b 71 -l compress -t 16 -R -q -s 10

• -t 16 — match your physical core count. Using every hyperthread sometimes makes it slower.
• -R — jump around the range at random. Reduces overlap when you run several machines.
• -s 10 — print the rate every 10 seconds. Put that number into the calculator.
• -k — BSGS mode only. Trades RAM for speed, and simply dies if there isn’t enough. Start at 4 and work up.

6. If you find one — moving it without losing it

This is the most important section in this guide. Finding one is hard, but people have found one and then had it taken from them.

Moving coins off a puzzle address means signing a transaction, and a signature carries the public key with it. The moment that transaction appears in the public mempool, a watching bot reads the public key. And everyone knows a puzzle key sits inside a narrow range — with the public key and the range, Pollard’s Kangaroo recovers the private key in seconds.

If that sounds like Bitcoin as a whole is broken?

Take #66: the range is 2⁶⁶, so Kangaroo needs around 2³³ operations — about ten seconds on a GPU. The bot then builds a transaction spending the same coins to its own address at a higher fee, and yours gets pushed out. That is exactly what happened to #66 and #69 in September 2024.

Private submission, concretely

The one route currently open to an ordinary person without a separate agreement is MARA Slipstream. Since August 2026 it has been open to the public, with no application and no special client. Submit the signed raw transaction and it stays out of the public mempool, sitting in their queue alone until MARA mines a block. There is no extra charge — you pay the normal network fee.

1. Prepare the destination address first. A fresh address from a hardware wallet is good. No key is needed for this step, so get it done before you find anything.
2. Build and sign the transaction offline. bitcoin-cli signrawtransactionwithkey is enough. The machine should be disconnected, and what comes out is a single signed hex string.
3. Submit that hex to Slipstream. Do not paste it anywhere else — a block explorer’s “broadcast” box, a wallet’s broadcast button, an accelerator: all of them go to the public mempool.
4. Wait. This is what the method costs you. See the table.

There are several ways to submit. You can paste it into the Slipstream web page directly, or use something like Outofband, which relays PSBTs and raw transactions to Slipstream for you. This site’s own withdrawal tool will send it the moment you paste it in — and it takes transactions signed on a Keystone or Coldcard as they come.

MARA’s pool holds about 4.7% of the hashrate (Hashrate Index, May 2026), which works out to a block every 213 minutes on average. It is a Poisson process, so the spread is wide — be prepared to wait a day. Nothing is exposed anywhere while you wait, so do not get nervous and switch to a public broadcast. That is the most common way this fails.

For reference — not every puzzle is at risk

Once the public key is out, the time Kangaroo needs scales with the square root of the range. So the higher the number, the safer a public broadcast becomes — the bot simply cannot finish the computation inside one block.

Based on one GPU at a billion operations per second. A bot running a hundred cards is a hundred times faster, which pushes the boundary up to roughly #95. #71, the one people are working on now, sits squarely in the middle — private submission is not optional there. At the other end, #140 and above already have their public keys exposed and would take months for anyone to recompute, so this particular risk barely applies.

7. Before you join a pool

Since going it alone does not add up, joining a pool is an option. btcpuzzle.info runs a “solo pool” — you get assigned a range, and whoever finds it keeps the whole prize. The client is on GitHub, a CUDA program forking VanitySearch with a pool communication module bolted on.

Reading through that source, here is what holds:

• On the default settings, no key goes to the server. save_key=false, telegram_share=false and api_share=false are the defaults, and in that state a found key is printed to your local console and nowhere else.
• The path that does store on the server is properly locked. Both save_key and untrusted_computer have to be on and the encryption has to succeed before anything is sent — and the encryption uses your own RSA public key. The operator cannot read it either.
• Telegram and webhooks are plaintext. Turn telegram_share=true on and leave untrusted_computer off, and a found private key travels in the clear through Telegram’s servers. If you want the notification but not the exposure, turn both on.
• Encryption failure falls back to plaintext. If RSA key loading goes wrong it logs the error and sends in the clear anyway. After configuring it, verify with a test output that encryption is genuinely applied.
• The operator knows exactly which ranges have been exhausted. That is structural and unavoidable, but go in knowing it is valuable information.

The pool itself is reasonably designed. What you have to know for yourself is what gets exposed when you change a default.

8. What not to do

• Pointing this at an address that isn’t a puzzle. That is not searching, it is attempted theft. And it will not work anyway — look at the numbers on the scale page.
• Paying for a “key database” or a recovery service. All of them are scams. Without exception.
• Typing a seed phrase into some website. A site offering to check your balance is not checking anything; it is collecting.
• Burning electricity while ignoring expected value. Put your electricity price into the calculator. On most setups the power costs more than the prize.
• Running somebody else’s compiled binary. Especially on the computer you touch wallets with. Build from source.