160 wallets with the range narrowed on purpose
On 15 January 2015, saatoshi_rising sent bitcoin to 160 addresses in a single transaction. Each private key was drawn from inside a fixed, narrow interval, and each interval is exactly twice as wide as the one before it. The purpose, in their own words, was “a crude measuring instrument of the community’s cracking ability”.
What makes it acceptable for the finder to keep it
On 31 May 2019 the creator withdrew 1,000 satoshis from every address whose number is a multiple of five. A withdrawal carries the signature and the public key with it. Once the public key is known, Pollard’s Kangaroo replaces brute force and the difficulty drops from O(2n) to O(2n/2) — a square root.
What Kangaroo isWhether your wallet is at risk
It is why #125, #130 and #135 fell before #71 did. The exposed ones still unsolved are #140 #145 #150 #155 #160 .
On 12 September 2024 puzzle #66 was solved — and the solver’s broadcast was replaced by an RBF bot, which took most of the prize. The same thing happened again on #69.
Moving funds off a puzzle address means exposing the public key and the signature, and at that moment a bot watching the mempool takes the same coins with a higher fee. How to prevent it is in the guide.
What “narrowing the range” actually means
“I made my wallet by rolling dice a hundred times. That's still some number inside 2256. So my key is inside a range too — how is that different from the puzzles?”
Correct. Every key is inside a range. Which is exactly why “inside a range” distinguishes nothing. What matters is how many candidates that range contains.
The box holding the key to puzzle #71 contains 270 candidates. The box holding the key you made with dice contains 2256. Both are “inside a box”, and the boxes differ in size by a factor of 2186.
a3f9c14b7e2d0856bf31a90c5d47e8236fa1b0c9d85e37241f6b8a0d59c3e7b2
0000000000000000000000000000000000000000000000349b84b6431a6c4ef1
0000000000000000000000000000000000000000000000400000000000000000
“There is no pattern. It is just consecutive keys from a deterministic wallet, masked with leading 000…0001 to set the difficulty. It is simply a crude measuring instrument of the community's cracking ability.”
| Dice rolls | Entropy | Candidates | Verdict |
|---|---|---|---|
| 20 rolls | 51.7 bits | 2^51 | unsafe |
| 32 rolls | 82.7 bits | 2^82 | safe for now, below standard |
| 50 rolls | 129.2 bits | 2^129 | comfortably safe |
| 64 rolls | 165.4 bits | 2^165 | comfortably safe |
| 99 rolls | 255.9 bits | 2^255 | recommended standard |
If the table feels abstract, hold it against the puzzle list above. The 51.7 bits you get from 20 rolls is the same search space as puzzles #52–#53. And #52·#53 fell a long time ago. Thirty-two rolls (82.7 bits) is around #83~#84, which nobody has solved — safe for now, with no margin at all.
A die has six faces, so one roll is log₂6 = 2.585 bits. Ninety-nine rolls reach 255.9 bits, essentially the full 256 — if you rolled a hundred times, your key was not narrowed. Rolling more cannot exceed 2256, so there is no point. If you are pulling bits from coin flips or odd-even dice, that is one bit at a time and you need 256 of them.- Brain wallets — build a key from “a sentence I can remember” and the candidates stop being 2256 and become “the few hundred million sentences a person might think of”. Gone within hours.
- A broken random number generator — when a seed collapses to 32 bits, as in Milk Sad (CVE-2023-39910), there are 4.3 billion candidates. A laptop can enumerate all of them.
- Numbers a person chose — birthdays, repeating patterns, counting from one. Something feeling “random enough” has no relationship to entropy.
What they share is that nobody involved knew they had narrowed anything. The puzzle creator did the opposite — deliberately, and in public. Which is why the puzzles are an instrument rather than a broken wallet, and why a properly made wallet is still a needle in the universe.
All 160
Filter by state, prize or range. Balances are re-read from the chain every 15 minutes for unsolved puzzles only — the solved ones were all emptied long ago and sit at zero, and hitting a public API with 160 lookups every time would be rude. The private key column holds values that are already public, and every solved key was re-derived with secp256k1 to confirm it matches its address.
Showing 77 of 160. Press “Re-check now” and your browser queries the chain directly.