Don’t believe it? Run it yourself.
What follows is not a simulation. Your CPU performs real secp256k1 scalar multiplication to turn a private key into a public key, derives a Bitcoin address through SHA-256 and RIPEMD-160, and compares it one at a time against all 77 puzzle addresses nobody has solved yet.
Press start and real secp256k1 arithmetic begins.
“Isn't this basically a lottery?”
Watch it run for a while and the thought arrives on its own — the lottery has terrible odds too, and people still buy tickets. That instinct is sound, so here it is placed next to a real 6-from-45 lottery draw. The answer is not “both are unlikely”.
The number of ways to pick 6 from 45. This is the figure people mean when they say “less likely than being struck by lightning”.
1 / 1180591620717411303424
The lottery jackpot is 1.45×10^14× (about 145 trillion) easier.
Roughly like taking the jackpot three weeks running. Strictly, the puzzle is 2.2× harder than that.
That is how many keys you have to look at before your odds match a single lottery ticket.
The jackpot is around $1.4M, and puzzle #71 holds 7.1 BTC — they trade places as the price moves. Comparable prizes, and odds that differ by 145 trillion times.
With a lottery, spending more only raises your odds linearly. Ten tickets is exactly ten times. And however many you buy, it draws once a week at a fixed hour.
The puzzle is not like that. Add hardware and it keeps running continuously, and ground already covered does not need covering again. Set the button above to 4090 × 1,000 — one lottery ticket's worth of odds accumulates every minute. That is 1,400 tickets a day, half a million a year.
This is the only reason the puzzle is not a lottery, the reason 83 have fallen, and the reason people form pools. Without hardware on that scale — and most people have none — it is simply a very bad lottery.
How this is calculated: the 6/45 jackpot is 1 in C(45,6) = 8,145,060 (= 1.228e-7). The private key for puzzle #71 lies somewhere in 270 ~ 271, so one random guess has probability 1/270. Jackpots swing a great deal with the draw and the number of winners, so that figure is approximate. The calculator lets you try other puzzles and other hardware.
“But a GPU does 2.5 billion a second”
Having read this far, the obvious rebuttal appears. Five dollars buys you a handful of lottery tickets, but five dollars of electricity buys hundreds of billions of keys. Surely the GPU wins by a mile?
That is a perfectly reasonable instinct, and “2.5 billion a second” is genuinely true. The catch is elsewhere — those 2.5 billion are not free. Lottery tickets cost money and so does GPU time, so the comparison only means anything once both are converted to the same budget. Put your own conditions into the sliders below.
450W · 2.5×10^9 keys/s · $1,800
US residential runs about $0.10–0.20; industrial rates are lower. Set it to zero for the case where power is free.
Default is the live price. Puzzle #71 prize 7.1 BTC ≈ $558K
- Odds of winning
- 1 in 1.2×10^6
- Expected value
- $3
- Return rate
- 50.0%
- Odds of winning
- 1 in 3.2×10^6
- Expected value
- $0.17
- Return rate
- 3.5%
The GPU search returns 3.5% against roughly 50% for the lottery. For the same money the lottery is 14× better. “2.5 billion keys a second” is true; the trap is that those keys are not free — they come out of electricity and depreciation.
- It accumulates. Buy lottery tickets for a hundred weeks and week 101 is still 1 in 8,145,060. Every week starts over. Split a puzzle range into recorded blocks and sweep it sequentially and the remaining space genuinely shrinks. — But picking at random accumulates nothing. You keep re-checking ground you have already covered. That is why pools assign ranges.
- There is no ceiling on capital. However much money you have, a lottery draws once a week at a fixed time. Buy a thousand GPUs and a thousand times the work simply keeps running.
- Winner takes all. A lottery jackpot is split between everyone holding the numbers. Whoever finds a puzzle key first takes all of it — assuming they can get it out.
- But it can be taken from you. Win a lottery and you are paid. Solve a puzzle and an RBF bot can still take it during the withdrawal, as happened on #66 and #69. The expected values above do not account for that risk.
How this is calculated: hourly cost = (GPU watts × electricity) + (GPU price ÷ depreciation period). Hours your budget buys × keys per second = keys you get to look at. Probability = keys ÷ 270. Expected value = probability × prize. The lottery's 50% return is an approximation of total prizes against total sales. GPU speeds, prices and electricity are all approximations — put your own numbers in the sliders.
Read this with it going in the background
Why sequential beats random
Getting a public key from a private key k means k multiplications on an elliptic curve. But raising k by one is the same as adding a single point — P(k+1) = P(k) + G. One addition is far cheaper than one multiplication.
Which is why every real searcher, keyhunt and BitCrack alike, sweeps its range in order. The instinct that “picking at random feels more like a lottery, so it must be fine” and the method that is actually fast are two different things.
You can measure the gap above. Alternate between the two modes and, depending on your browser and the range size, sequential runs roughly 1.5 to 3 times faster. The narrower the range, the lighter the big-integer arithmetic, and the smaller the gap.
Why it compares HASH160 rather than addresses
An address string (1PWo3Je…) is a HASH160 with a checksum appended, encoded in Base58. That encoding is expensive and contributes nothing to a comparison. So this tool stops at the 20-byte HASH160, exactly as the real tools do, and only runs Base58 once — if there is ever a hit.
Generated private keys exist only inside Web Worker memory and are discarded immediately. What crosses to the main thread is the attempt count, the rate, and the current position.
Don’t take that on faith. Open F12 → Network and start the search: the request count does not move. Save the page, disconnect from the internet, open it again, and it runs exactly the same.
It is not a screen you will see, but if it appears, do not withdraw first. The moment a transaction moving funds off a puzzle address is broadcast, it carries the public key and the signature, and bots take the same coins with a higher fee within seconds. That is exactly how #66 and #69 were lost.
All 77 unsolved puzzles. The smallest is #71 (270~271, 7.1 BTC), the largest is #160 (2159~2160, 16 BTC). 903 BTC between them.
Leave it on “the whole key space” and there is effectively no way to hit any of these targets. Switch to the puzzle range and you are at least searching the correct interval. That difference is a factor of 2185.