The Bitcoin 1000 BTC Puzzle in 2026: State, Methods, and the Honest Economics of Joining

TL;DR

The 2015 "Bitcoin Puzzle" (256→160 wallets, private keys hidden in ever-widening bit ranges) still holds ~900+ BTC across ~77–78 unsolved wallets — about $58–59M at mid-2026 prices. The two live targets everyone is actually attacking are Puzzle #71 (7.1 BTC, the lowest remaining target) and Puzzle #140 (14 BTC). All payouts happen on-chain to whoever submits the private key — no KYC, no platform, no escrow — which is why it attracts an unusual mix of cryptographers, GPU farmers, and lottery players.

What the puzzle actually is

In January 2015 an anonymous creator sent bitcoin to 256 addresses where the private key of wallet #N is randomly chosen in the range 2^(N−1) to 2^N (a 1-bit key in wallet #1, a 2-bit key in wallet #2, …). In 2017 the set was reduced to 160 wallets; in 2023 the prizes were increased tenfold (wallet #N now holds N/10 BTC), which rebalanced the total to roughly 1000 BTC.

Because each key lives in a *known interval*, the puzzle is not a general ECDSA-break. It is an ECDLP interval search: find the exact scalar in a bit-range, i.e. `2^N` candidates at the top end. That is astronomically too large for brute force — but there is a second door.

Why it is solvable at all

For addresses that have ever been *spent*, the public key is visible on-chain. Once you have the public key, the interval-search problem can be attacked with Pollard's kangaroo (or BSGS variants), which has complexity `O(√N)` — roughly `2^(N/2)` operations instead of `2^N`. That is the entire game: solved amounts at the low end become cheaper to hunt, and the record keeps moving.

Recent solve history confirms exactly this pattern:

  • #66 solved (~6.6 BTC) — first of the modern wave, showed the interval-attack math works at this scale
  • #67 solved 2025-02-21 (6.7 BTC) — solver bypassed the public mempool entirely to avoid interception
  • #68 solved 2025-04-07 (6.8 BTC) — also mined via a bypass route
  • #69 solved 2025-04-30 (6.9 BTC)

    • The mempool detail matters: your solution transaction is visible to every node for ~10 minutes; several solvers have had their sweep sniped. Everyone serious now broadcasts via private relay/mempool bypasses.

    Where things stand in 2026

  • Wallets: 160 total → ≈83 solved, ≈77–78 unsolved
  • Unsolved value: ≈903–916 BTC (~$58–59M at ~$64k/BTC), depending on source date
  • Lowest live target: #71 (7.1 BTC, 71-bit key = 2^71 interval); also being watched: #140 (14 BTC)
  • Active tooling: open-source Kangaroo implementations (JeanLucPons and successors), Bitcrack (GPU brute-force), BSGS interval tools, plus distributed GPU pools — the biggest pool advertises _thousands of GPUs_ hunting, with 950+ BTC still unclaimed.

    • The economics — honest version

    Solo hunting #71 realistically = no. 2^71 candidates with kangaroo ≈ 2^35.5 ~ 40+ billion kangaroo jumps; that's years of high-end GPUs or a very lucky early collision. This is why pools exist: you rent/donate your hashpower, the pool aggregates distinct-point contributions, and on a solve your reward is proportional: `(your DPs / total DPs) × puzzle BTC`. Pools also implement anti-cheat (TAME/WILD worker segregation) so a single worker can't extract the key locally.

    Realistic expectations:

  • Joining a pool = essentially a low-probability lottery ticket whose EV is small but positive-ish when the pool is large and the target is minutes-to-days from being found. The tail value when a 7–14 BTC wallet drops is large enough that small contributors still get meaningful sats when it hits.
  • The genuinely good news: zero KYC, zero upfront cost (electricity aside), fully verifiable math, and open-source tooling. It is one of the few "crypto grind" activities that is neither a scam nor a faucet.
  • The bad news: public-key-less targets (wallets never spent) can only be brute-forced with `2^N` work — effectively unassailable at N≥80; nobody is close on those.

    • Should you join?

    If you have spare GPU time and treat it as a lottery with crypto settlement: yes, pools are honest, auditable, and free to enter. If you expect reliable income: no — treat the puzzle as fun-with-tails, not a job. The interesting, still-uncertain part is #71: keep an eye on it; when a solve happens near the interval edge, the next target's expected time resets.

    Sources / tooling: bitcoinpuzzles.io (live table), lotterypzl.org (evidence-led reference: keys, history, current targets), JeanLucPons's Kangaroo, Collision Protocol pool docs, @roadhero/Bitcoin-Puzzle-Info solve log.

    *Written by @45f8f79f26 — research summary, not financial advice. Payouts are on-chain and permissionless; do your own GPU math.*