Krackpot KANGAROO DEMO

A Bitcoin private key, recovered from its public key

A Bitcoin private key is normally unfindable. But when the key is known to sit inside a narrow range, handing over the matching public key changes the problem completely: the work drops to roughly the square root of a brute-force sweep. This page does it to a key it makes in front of you, so you can watch how quickly it happens.

This has really happened, more than once. Bitcoin Puzzles 66 and 69 were both front-run and stolen by bots in the seconds between their solvers broadcasting a spend and it being mined. The bots read the public key out of the mempool, recovered the private key, and rebroadcast at a higher fee. The two puzzles solved since are both reported to have been claimed without a public broadcast, though their solvers have not said so.

The demonstration

Runs in this tab

Range

01 With only the address

An address reveals nothing but a hash. The only way in is to try keys one at a time and hash each one, which is what the main Krackpot search does. Let us find out how fast your machine does that.

Runs the real search kernel for about two seconds. Nothing is sent anywhere.
Keys to try, on average half of
Time on an RTX 3070 at 22.55 million keys/sec, measured

That figure is a reference card rather than yours, and it is calculated rather than run. The kangaroo runs on your hardware, so the two sides are not measured the same way. Measure your machine to make them match.

02 With the public key

Now the attacker gets what a spend would publish. Pollard's kangaroo walks two herds through the range, one from a known position and one from the target, until their paths collide on the secp256k1 curve. It needs about jumps against the keys above, which is times less work for the same key.

That is what happened to Puzzle 66. Its solver published a spend, which handed a watching bot the public key and so the work above. The coins moved before the original transaction confirmed.

That ratio counts operations, so it is the same on any machine. What changes with your hardware is how long each side takes.

range start range end 2⁵² keys wide, and the key is somewhere on this line TAME · FROM A KNOWN KEY WILD · FROM THE TARGET COLLISION key = start + Δ the gap between the two walks is the answer
The hops are drawn evenly so the picture stays readable. Real jumps vary in size, and a walk picks each one from a table indexed by where it currently stands. So two walks that ever land on the same point read the same table entry, and stay together from there on.

03 What this does not show

The attack above depends on conditions that ordinary Bitcoin keys do not meet.

Ordinary Bitcoin keys are not affected by any of this

A properly generated private key is spread across roughly 2to the power of 256 possibilities. The square root of that is 2to the power of 128, which is not attackable by anyone, with any budget, ever. The kangaroo only helps when the range is already known and already narrow. It solves the interval discrete logarithm problem, so with no interval there is nothing for it to walk.

Publishing a public key is normal and safe

Every reused address, every pay-to-public-key output, and every Lightning channel exposes a public key, and none of them are in danger. The risk here needs two things at once: a range that is known and narrow, and an exposed public key. One without the other is nothing.

The danger is anything that shrinks the range

Puzzle addresses shrink it deliberately, which is the whole design of the puzzle. The real lesson is the accidental case: a broken or low-entropy random number generator produces keys from a range far smaller than it should, and if one of those keys ever exposes its public key, the same arithmetic applies. That is a genuine class of wallet bug, and it is the reason this demo is worth publishing.

Nothing here implies that Bitcoin is broken, that quantum computers are involved, or that your wallet is at risk. The claim is narrower than that.

01 · YOU, THE SOLVER YOUR CLAIM 6 BTC to you fee 69 sat/vB reveals pubkey 02a1… 02 · THE PUBLIC MEMPOOL Unconfirmed, and visible to everyone. The public key is now on the wire, and the range was never a secret. 03 · A WATCHER runs kangaroo on that pubkey key found, seconds 04 · THE REPLACEMENT 6 BTC to them fee 900 sat/vB same output, higher bid THE MINER takes the higher fee. Only one of the two spends can ever confirm. YOUR CLAIM DROPPED You did the work. They took the coin. This happened to Puzzle 66 and Puzzle 69. It is why Krackpot never broadcasts a claim to the public mempool.
The watcher does not replace your transaction. They cannot, because replacing it would mean signing it. Instead they spend the same output again at a higher fee, and the miner takes the better bid. Bidding higher yourself does not help, because the watcher can always go higher again. Submitting privately is what closes the window.

The same WGSL engine, pointed at a real 7.1 BTC target: krackpot.io