Bitcoin puzzle #66 was solved: 6.6 BTC (~$400k) withdrawn
A long‑running “Bitcoin puzzle” address with a deliberately weakened private key was finally brute‑forced, allowing someone to claim 6.6 BTC — only for a bot to front‑run the winning transaction by exploiting how public keys are revealed and miners prioritize higher fees. Commenters unpack how these puzzles work (reduced‑entropy keys, Pollard’s rho, special cases where public keys are known) and why they’re seen as a public benchmark for practical attacks on Bitcoin’s elliptic‑curve cryptography. The event also reignites debate over proof‑of‑work’s energy use, whether such compute races create any real value, and what would happen if more efficient or even quantum attacks on Bitcoin’s security assumptions emerged.
Overview of Bitcoin Puzzle #66
- Bitcoin “puzzles” are specially constructed private keys with reduced entropy (many leading zero bits) funded with BTC as prizes.
- Puzzle #66 had 66 “unknown bits” (actually 65, since the top bit is fixed) and a 6.6 BTC reward. It was finally brute‑forced after ~2 years, roughly matching the expected 2^66 search.
- Puzzle #67 (and onwards) are similar, with n unknown bits and n.x BTC rewards; every 5th puzzle has double entropy but a published public key to allow Pollard‑rho style attacks.
How the Puzzle and Attack Work
- Normal keys are 256‑bit ECC keys (secp256k1). Here, most bits are zero and only a small range needs to be searched.
- With only an address (hash of a public key), you must brute‑force private keys directly.
- When a transaction is created, the public key is revealed. Knowing the public key allows discrete‑log algorithms (e.g., Pollard’s rho) that reduce work from 2^n to about 2^(n/2).
- For the puzzle, once the solver broadcast a transaction, a watcher bot used the now‑known public key plus the low‑entropy structure to recover the private key quickly and submit a higher‑fee, conflicting transaction, effectively stealing the 6.6 BTC.
- This type of front‑running is specific to reduced‑entropy puzzles; normal 256‑bit keys remain computationally infeasible to brute‑force.
Security and Cryptography Discussion
- Commenters clarify discrete logarithm problems, elliptic curves, and Pollard’s rho; note that “discrete log” is a family of problems that depends on the specific group.
- Several see the puzzles as canaries or benchmarks for brute‑force capabilities and potential sub‑exponential or quantum attacks, though others argue real attackers would not reveal such capabilities via a public puzzle.
- There is debate over whether this constitutes a “puzzle” versus a pure compute race.
Energy Use, Ethics, and Value
- Strong disagreement over whether this is an interesting cryptographic challenge or a “sick” waste of electricity.
- Some argue all puzzles are intrinsically “wasteful”; others say this one at least yields information about attack feasibility.
- Long subthread on whether using “green” energy for mining or cracking is still wasteful, given opportunity costs and grid constraints.
Practicalities: Claiming, Tax, Liquidity
- Suggestions to avoid front‑running include private mempool submissions or direct deals with mining pools; mining a block yourself is the only fully trustless option.
- Liquidity for 6.6 BTC is considered trivial on current markets, but off‑ramping can trigger bank and exchange KYC/AML scrutiny.
- In the US, some suggest puzzle proceeds would likely be reported as “other income” for tax purposes.