Bitcoin Graffiti work in progress
← Timeline text · 2026
I made a Bitcoin puzzle using information contained in the genesis block created by Satoshi to generate the wallet.

The entropy is extremely low. I didn't even need to back anything up. Everything I needed was already in the genesis block.

Good luck!

---

If you have a question, you can include it with a transaction sent directly to this address, and I will reply with a hint.

Larger payments receive better hints. Dust transactions will be ignored.

---

Is the witness script a hash lock, a multisig, or something else?

---

The witness script is a multisig.

---

How many keys, what threshold, and how are the keys derived from genesis?

---

Two keys, both required. The rest is for you to derive.

---

Are both keys from the same genesis field, and is the function a hash?

---

Yes, both keys use the same Genesis field, and there is no hash.

---

Is the second key derived from the first, or both from genesis independently?

---

Both keys are derived independently from Genesis.

---

Which genesis field, hash, merkle, nonce, time, headline, or pubkey?

---

The Genesis Block is public. Which part of it matters is for you to discover.

---

Prize Address?Genesis field 32 bytes or smaller?

---

Give a hint at your will!

---

Can you give any hint about derivation offset/rule?

---

Solve it to find out. Maybe both.
If you can't check the Genesis block, you can also use The Times newspaper!

---

Derivation rule: root -> multisig -> mainnet -> genesis_data -> script_type

---

give another hint

---

I can't give hints without a question. Low-value transactions get bad hints; dust will be ignored.

---

Root = Times text as BIP32 seed? BIP39? raw key? genesis_data = BIP48 account?

---

root = the master key derived from the BIP39 seed; genesis_data = some data from the genesis block used as the BIP48 account number.

---

BIP39 entropy: genesis bytes/puzzle text/img/other? words 12/24? passphrase Y/N?

---

BIP39: 12 words; Passphrase: Y; Entropy: The data needed to solve it is publicly available in the genesis block.

---

Passphrase: genesis data or your own word? How long? What built the wallet?

---

Passphrase: Who received the first transaction? That's all I've got to say. What built the wallet are the tools that support BIPs 32, 39, and 48.

---

Passphrase sha256 first 8 hex? Entropy: raw 16B slice of Times or sha256?

---

No, the passphrase is a name. The entropy isn't the raw 16 bytes.

---

Do both cosigners use the same 12 words and the same passphrase?

---

Were the 12 words generated from entropy, or chosen directly as words?

---

Perhaps... but figuring that out is part of the puzzle. The 12 words were generated from entropy.

---

Is the 128-bit entropy a zero-padded number, a digest, or neither?

---

It's a 128-bit digest.

---

Passphrase fmt: first/full/middle name? spaced/joined? lower/UPPER/Capitalized?

---

Passphrase: You'll have to discover the fmt through brute force. The key question greatly narrows the search space.

---

Digest input: typed text, raw block bytes, a file, or something else?

---

The genesis block data can be viewed in binary, hex, decimal, or ASCII. If you figure out which part is being used as the entropy, just try all four forms.

Want a valuable hint? Send 50k sats and I'll reveal the public keys for this address.

---

Is the hashed part a header field, the coinbase text, or the whole block?

---

Somewhere in the genesis block. The hints reveal the puzzle's shape, not the path to its solution. Brute force will be necessary to uncover it.

---

Which block part + which hash gives the 128-bit entropy? One line.

---

Can I pay 50k for the pubkeys encrypted to this tx's input pubkey (Electrum)?

---

First 128 bits of SHA-256 hash of the genesis block's entropy.

Encrypted pubkey: 50k sats output + 1k input.


---

50k+1k: please send the 2 pubkeys Electrum-encrypted to this tx's input pubkey

---

QklFMQLXk4PoJBD8+XWI5H23h6N7YKwFMrp1rgqZ5lLaIq5rIxducdHgp02Jy4zUOt8Fpyvf5dCFBO23CfBEUwuDJP8sSVtVcN7Yz+TFrEQ+JjZrqGgttS32a66Irreq7TKitwC4RWctXEv87xn39bPE0qrdFET6VT3zxzmm7tXFYkJLXYDgCKk1Spi1DNQCbML3/8nGWLKUYaXerRBeShdQDcpoqDw/qM15+plACSCZ6Ip8Pgp9dOL4TaNK/H0iwRt19U1eZolj2XDQsRylj8jTTcHW3PK/LA0XKVR55YpcoanKnw==

---

50k+1k: please send the 2 pubkeys Electrum-encrypted to this tx's input pubkey

---

QklFMQNRHjQ1l0DYt++arP+U1vtqskJ3HRAB6rbZXZ3R4Yv2Cgqp/9v8/fnntGq2DhJ1oZS8Urlv365lQ4o5fUTG1rQbyVobdqHj19sINgAAzGPz46rVA59iIGkWDcCnpvliska67WumBnKVdf2J+m9ZqdY0Y66psTm/O9Lpo7AQzWYScRvcF2s8wBocSqlkFJJrFP8fyhL1s5b6zYg041rIf3bEQYVCxSB+SdnLPF811Vv07aayxFFXKZua1yOBHp/KF1iYtn5liLezwvGf1qFc5G7LPgwhHxSlILDXN5MYAg5bcA==

---

Encrypted Q to bc1qyas2 key: QklFMQPpMZCj3Z0vpzPNPtHtfuRm7mQH243aNHcFt4mp0zfgwzrnhXlwu5BNO0wUlSgD33/EpAc3QRHYjSU94RwQnHUgapzxQIFfF2qtI8caJuq0pEmQm5PlSEDK+qOmjSIjcpNvAGWtp6nRd816LYeixRfmC1yPe5KSsGlRVyzWJ0v6Fo55eQYrEytd+qoO2BIplr2dB91WHcOXUpEZO6zTwVuGOxrzBH8f6K5zYZbw5eg+ZHIgygebgP3w8lkXvNn2pfFBjv/3+LHBJwviQ4TPl/xLIAoi3dpMzeTFp7BGkoLUbbKK8razBgXGnCot5dDAg6B8VDGr4W013y3AV9WTYxuhYbQIBmKS10vVwoG5eVwd5cJrFCHYXmGzTGB35pbahSRAhraDXRTKopuGLa4IsyQMleD1X+x6u8lG17Dl7w0NgdAFjHjcwfRvC0Bxvrrisk8PMOelO6bHOBz968awCe7/

---

Depends. I'm going through batches of unlikely hypotheses with Claude and writing brute-force scripts with it. Though some of the alpha is mine. I'm 0xflorent. Doubted the paid-hint process at first, but I was wrong, I love it.

---

I'm curious: Are you using an LLM and brute-force attempts?
               
Encrypted Q to bc1qax0h key: QklFMQLsJWXx0QFNcix2rW5D7aEu/HLUTIgzh7NXpqrr8LKotKfSc1C+ajk2nK5eoZJbs4l7vw7EsscevG4Q6Ft/H70FCEPgyM40++TOC6b7rBcnDaNvYCv7KQbHF6Z3xK3Z8AQkZH+3/ZnLymSCbwENOum9zr++SOeJOLHom9lqoqa49WK8Wh2BL5jijo9qDi1ddu/WMWq3ME/d7XYvz0pNpHcskbnn3pDX1XeU3n0hbW8oRg==

---

Encrypted Q to bc1qyas2 key: QklFMQI9DjhBYqs4Z5Vd239cijPZishiBGE5Wo9LhB2z9K7RohIX5ctonXf35jRmoj/kw2Faxej/d8NrBO0z4S45ENKs4BbuTTHLNq6no8d3BUOa831LOSfaoF7usiYn6iwJMgV99QHXDZvjTPeemYK9yV7iayoSOy58fVvnQSz7npJYIqgdCYgVgBUd1tX0UFCqUx1rWXVCi+E6qfFNXCB+GS+WDXkf8UOb4LHNA3+M2sWDvvTL2B97AB0eybHiLPdFzSSfQYvGPnerZWyGbzkAwdJsM3Aj25EmHpmmT61oKAAKUi51Y3oJF3t1GGuq4oDpIG14Yv3dOvxXBr8+oAZM/SZYyqqkPWigwjarENJgo9jdAMDZZo2Z4cqHuZKTH+1N1+BvgqECu7qrkxiGpjIKk285UgUQauy6MhDhpKuWSRB10Q==

---

Encrypted Q to bc1qax0h key: QklFMQOCijbVXZjGxyKbKSA5XZOeVJ0WdFDsrAbCWB1Vo+G8FNhmWqji9DYyZpihY0xBv266WCtJDaQA7HzWVDTjUTmOHSb/sZgFawMNJJQeNDbXSuf0aUJvMAbfdiY2JtgUdzgdzsovFvhLaGfw5D9Np7sYDgJEZ3CWqOn22yK6ou0H7vM2AQbDdAgd/helrcocoIbxzo/nyb0b89T8wPyfO5YfLkAOdPezc11mRQjUb/yxtk2ea9QI5haI25/AZmNdsLSurzGRqpl2RZ1qppyt/ciibeFg4g0udOrmJ+BYyJT5bXpx9glxCvXxu7lwgq4I6EKI54BPmTzPxR57LNlfkOPpdPfYUqnrv3ntSvibdEqySvtllDXQ1aeUh5sP55bxv4kuE0aeTh3wjSscB1csg6ADMTR6mVzZcwlVgl5TGRhGJXlpnn09jOYA8WAPd2FRhNcTbxVNT5R4JIgO1bB6ofb6a4amsv244a8IgdJu6TsDqAhrd+6pJlCGcULjcGCpff+sPU8/LIrvDAYhWcbAYK0sZMHemK4P90nnjR9HMjMFocH0BnxkaICCeTZPmF/r8Rzj4Ndq/dZxau0d047d3gWGYZivoGd5YimQZ/lQokunC9jTJKZGiKdj8+yj5TxcjEEr6l+p08F2uRlH4/FhL9cxHd07Cq4rK/qBWOi8C9ItQHTu7tppgcFkWQV07rbA4d/TJuli33b0hNLEFrR/t/fw5I1DSgy+uLYILMhBRLITGm3kiRhKMG7YjJ+M92zV1dGDh/tjMiPXVO/kYNSkSlqgVQ6GJsowJOQGOhdKH72MHFp9qJFc9hD5jdaK0EDAPd78yXwXZpo/x0JDHf/56uku7vSS10vmuK1Ri53T9UZy9z7OYV9sQXHSchFOf2WGmE++P6WEzMJO5znXKvkvTluWz5a5vHacgfEMT67wXCn7pbIboZUsFwvjBOSbIOhJWDc=

---

Only the keys may go encrypted; the rest should be public. Why not swap emails?

---

Fair enough, I understand. I might ask another one today for 30k, feel free to decline if it gives too much away. I've seen someone complaining about encrypted conversations and they are right, I benefited from public hints too and will from now on ask everything publicly. For transparency, my last question asked for the master fingerprint of one seed without the passphrase. Author declined as it would have been too easy to solve afterwards. Also, my previous encrypted question asked for the key origins (master fingerprints and derivation paths) of both cosigners. I'll keep that one private as it's strongly related to the 50k public keys question. The author is free to confirm or publish any of his replies.

---

Two quick shape questions. 1) Is the hashed input a contiguous piece of the genesis block exactly as a standard tool shows it (explorer, bitcoin-cli), or did you combine or edit parts yourself? 2) Did you get it by copy-pasting a tool's output, or by typing it yourself? Here's 10k. Let me know if my declined 30k plus this is enough, or if you'd like me to top up.

---

It's a contiguous piece of the genesis block, exactly as a standard tool shows it. I got it by copy-pasting the tool's output.

---

0xflorent agreed publicly: please publish the derivation paths you sent him, or just the two BIP48 account numbers. I paid the 50k+1k for the pubkeys too.

---

Decrypted message: Offer 20k+1k (paid in this tx) for both key origins [fingerprint/48h/0h/acct'/2h], or at least both master fingerprints. Reply encrypted to this tx's input pubkey. Also: I'm really enjoying your puzzle, thank you. Let me know if encrypting ruins the game for you and I'll conform.

Encrypted Q to bc1qdu8m key: QklFMQMughI6NqjAa2c0LxyAq/1TOKvBBIolubSgOkDfLOxCZXtorX+AjjAHAiwOzcDPOXJzaiPrSMJCbgDqucS+VsIuPMeXeB+8WRD9v5dK/42HRKSSmSp3m09cHPYx4NV5s7dyru34+WJetYhAej5kELPlBzCxyjVke25JL7CpDqdM2CWhB7G/lZLZqEPy2WD1KgOd5GEIE3gl4x/x4s00+UjIb0HfLzk7dcjWQtVmuv1FeA==

---

Decrypted message: Offer 30k+1k (paid in this tx): the master fingerprint of one cosigner's 12-word seed with an empty passphrase (not <fingerprint>/<fingerprint>, which include it). Your choice of cosigner; both if you're willing. Reply encrypted to this tx's input pubkey. Thanks!

Reason for decline: The genesis block is only 2.5E-32 of the 2^128 possibilities. Revealing the seed's master fingerprint without the passphrase is basically giving away the entropy. All the secret pieces have to be cracked at the same time.

---

50k+1k: please send the 2 pubkeys Electrum-encrypted to this tx's input pubkey

---

10k: Y/N only. 1) Digest input = ONLY genesis coinbase Times/ASCII text (not whole block/header)? 2) Exactly tool copy-paste ASCII (bitcoin-cli/explorer)?

---

30k+1k: both BIP48 account numbers (m/48'/0'/acct'/2') for both cosigners, or both full key origins. Electrum-encrypt to this tx's input pubkey.

---

Encrypted Q to bc1qrzqq key: QklFMQNUDtZPeDTM6qjliSuO8dGBhxH4nwS1SAlO5pH2DhGE4SvZm892ivC9tI1BXw1vgw+P9MNc37ItpCyv6gvzMu4Q3g7UWCfvPlZ3ZLgOKl0xxMesHSC/OxILVq4+m4R3tX5M5e+N1ehmsQSMUDb7pDFcNQ0PE2cmL2R/f0u1FVWDq24VqQm6lGVYTp+dfcABYiz9UG091tnlZT0Ff6MeDo/ZeJ5Jzx5kerBIxXHxyhxB6dqt/xUAoR7FvERX0EPBA5M8LuIm3GuGBClhXoKVuy7/LGpclNBAqqqPmhCjmSqhyw==

---

Encrypted Q to bc1qlahu key: QklFMQJisdZ7brEwFI/FJyaJ/h1MNMW3Rff84xOlfMkC51g/QcKmCt9BWeeys3xFvDBc6FPr3Zfpzdi1spv3hxA2pWOg60mZq1usl38C/eBSd9jvba0hhgy+MM04w1Hzwp0erws1Qq0Vth2eky0rJ/8yxJGI7n3FfD5D6pqGL3bbwWdUFoOIuJECAPHo8z8fQJ8oQq5zz04oM2YIZSZHCDW1qiXuMvm/ZccVaIICuViBgLUDLg==

---

20k+1k, structure only: 1) App that made the 12 words: iancoleman.io Entropy box, Sparrow, other? 2) Entropy Type + Event Count it showed (else char count hashed)? 3) Pasted from bitcoin-cli/explorer/hex editor?

---

1) Apps/Tools used to generate the 12 words: bitcoin-cli, cut, jq, tr, sha256sum, iancoleman/bip39, OogaBoogaX/entropylab;
2) Genesis block is extremely small. This will have to be uncovered via brute-force;
3) Pasted from bitcoin-cli and also from an explorer.

---

1) N;
2) N.

---

50k+1k: please send first8hex(sha256(passphrase UTF-8 noNL))+first8hex(sha256(12 words lowercase single-spaces)) Electrum-encrypted to this tx's input pubkey

---

Declined for the same reason as before.

The puzzle wallet was built using secret components that are extremely weak on their own. Those components won't be disclosed or reduced to a searchable checksum. Revealing any one of them independently would turn part of the puzzle into an oracle for solving the others. So you'll have to recover the actual secret pieces and test them together. I won't provide any derived value that isolates any individual secret.

---

Shape only, one letter each. 1) jq/cut/tr changed: a) the text before sha256sum b) only sha256sum's output (e.g. cut -c1-32). 2) Words: a) Coleman "12 words" on that text b) first 32 hex as raw entropy

---

1) a;
2) b.

---

15k Y/N only: 1) Two different pastes for the two 12-word seeds (one cli, one explorer)? 2) Same passphrase both cosigners? 3) sha256sum input = UTF-8 text of paste (not hex-decoded binary)? 4) Ian Entropy Type = Hex (first 32 hex chars of sha256sum)?

---

10k Y/N+choice: 1) Hashed form = binary, hex, or decimal (pick one)? 2) Complete tool field value vs substring/cut? 3) Trailing newline on sha256sum input?

---

1) N; 2) Y; 3) Y; 4) Y

---

1) hex; 2) substring/cut; 3) N

---

10k Y/N+pick, shape only (no values): 1) Is FP 0852014c the cosigner whose iancoleman Entropy Type = Hex? 2) Is that cosigner's hashed hex copied from bitcoin-cli (vs explorer)? 3) Is the hex cut <=32 chars? 4) <=16?

---

10k Y/N+pick shape only: 1) Hex cut from getblock 0 raw hex (not a JSON text field)? 2) Source = header 80B / coinbase tx hex / other (pick)? 3) Cut length multiple of 2? 4) Same cut length both cosigners?

---

1) Y; 2) N (bitcoin-cli/explorer); 3) Y; 4) N

---

1) N; 2) genesis block; 3) Y; 4) Y

---

Shape only, no secret values requested. For cosigner 0852014c (the one you confirmed used Coleman Hex): 1) Before sha256sum, did any command delete, translate or squeeze hex digits, beyond letter-case conversion and whitespace removal? Y/N; if Y, which operation? 2) Procedure = one SHA-256 of the UTF-8 hex text, first 32 hex digits of the digest as raw entropy, standard English BIP39, 12 words? Y/N; if N, which step differs? 3) Your hint 'first transaction' = a) genesis coinbase b) the 10 BTC payment in block 170 c) other: which block/tx? 4) Does the passphrase contain any character other than ASCII letters A-Z/a-z or a space (any digit, punctuation, accent, non-Latin letter)? Y/N

---

1) Y; cut -b N-M: it deleted everything outside the selected range. 
2) Y. 
3) Key question of the passphrase: Who received the first transaction? That's all I've got to say. 
4) N.

---

1) Is 0852014c the fingerprint of the depth-0 BIP32 master public key derived from the 12-word mnemonic with the BIP39 passphrase applied? Y/N. If N, which node does it identify (no account number needed)?
2) Are both escrow public keys at the complete path m/48h/0h/Xh/2h/c/i (any X), with either c=0 and i=0..9, or c=1 and i=0..4? Y/N. If N: a larger index, or a different path?
3) How many space characters does the passphrase contain, counting any leading or trailing space: 0, 1, 2, or 3+?

---

1) Y; 2) Y; 3) ¬_¬

---

Shape only, for 0852014c:
1) Is the exact text you hashed 18-32 hex digits, nothing else (no line break, CR, space, quote), that appear uninterrupted, in either letter case, inside one of: the raw block hex (it holds the header, coinbase tx, scriptSig, Times text, pubkey), block hash, merkle root, chainwork, nextblockhash, target, address hash160 - whatever tool or field you copied it from? Y/N
2) If N, pick: a) it has a non-hex character; b) hex digits from 2+ places joined (e.g. cut over several lines); c) hex of a value not listed; d) listed, but length/case/ending differ from item 1.
3) Is the passphrase exactly two words with one blank between them, each word a name of the recipient (given name or surname)? Y/N
P.S. My memory's not that great either: youtube.com/shorts/e_8s8fn93Ww

---

1) N; 2) d; 3) Y.

---

10k+1k, shape only for 0852014c (letters/Y-N/pick; no paste, no cut indices, no PP spelling). Reply like: 1) b; 2) Y; 3) a; 4) c.

1) Your on-chain "d" (listed; length/case/ending vs clean 18-32 hex): which differences apply to the hashed text? Pick all that apply: a) length not in 18-32 b) letter case differs from the tool's usual form c) extra or missing char at one end — if c: LF, CR, space, quote, comma, or other?
2) Does your cut -b N-M start at byte 1 of the line/string you cut? Y/N
3) That line/string came from: a) bitcoin-cli piped to jq -r b) bitcoin-cli without jq c) explorer page or API
4) Which listed place: a) raw block hex b) block hash c) merkle root d) chainwork e) nextblockhash f) target g) address hash160

---

We tested 1.8M distinct passphrases of the form "name name", 2.7e11 (text, passphrase) roots in all, against both master fingerprints: 0. To tell a wrong name from a wrong algorithm, please run YOUR exact steps on this already-cut text: 000000000019d6689c08 (20 lowercase hex). sha256sum -> first 32 hex -> Coleman Entropy box, Hex, raw -> 12 words; BIP39 passphrase: Test Example; same wallet software as the puzzle. 1) First of the 12 words? 2) Master fingerprint (8 hex)?

---

1) host; 2) b7f4182b

---

1) a; 2) N; 3) c; 4) a.

---

10k+1k, shape only for 0852014c (letters/Y-N/pick; no paste, no cut indices, no PP spelling). Reply like: 1) b; 2) Y; 3) a; 4) c.

1) The explorer that supplied the raw-block hex you cut: a) blockchain.info / blockchain.com b) mempool.space c) blockstream.info d) btcscan.org e) other
2) That raw-block hex view was: a) compact API or raw endpoint (one continuous hex string) b) browser HTML page you copied c) a downloaded file d) other
3) Before cut -b, was that hex one continuous unbroken run with no newline inside the hex digits? Y/N
4) Reconciling Ask A (cut <=32, not <=16) with Ask E (hashed length not in 18-32), pick one: a) Ask A = cut -b range width; Ask E = resulting hashed text length (they differ if the line ends before the range end) b) both mean hashed text length; use Ask E (length not in 18-32) c) both mean hashed text length; use Ask A (still even 18-32) d) other

---

9k no tip, shape only for 0852014c (letters/Y-N/pick; no paste, no cut indices, no PP spelling). Reply like: 1) Y; 2) a; 3) b; 4) N.

1) Is the continuous hex you cut the usual lowercase genesis raw-block hex of length 570 (same bytes as mempool.space /api/block/.../raw)? Y/N
2) If N: which? a) header hex length 160 b) coinbase/raw tx hex c) block hash d) merkle root e) other mempool continuous hex field f) not pure hex-only / not continuous after all. If Y to 1): reply "-"
3) After cut -b, the hashed text length was: a) even, 2-16 b) even, 34-64 c) even, 66 or more d) odd
4) Did your cut -b range extend past the end of the string (hashed text shorter than the range width)? Y/N

---

1) b; 2) b; 3) Y; 4) d.

1) Y; 2) -; 3) c; 4) N.

---

10k escrow, no tip. Previous ask was sent to the wrong address (tip tx 4a197e9b...). Please answer THIS ask on escrow. Shape only for FP 040e2791 (B) + PP shape. No paste, no cut indices, no PP spelling. Reply like: 1) Y; 2) Y; 3) c; 4) N; 5) Y; 6) N.

1) For 040e2791: is the continuous hex you cut the usual lowercase genesis raw-block hex of length 570 (same bytes as mempool.space /api/block/.../raw)? Y/N
2) Ian Coleman Entropy Type for 040e2791 = Hex (first 32 hex digits of sha256sum as raw entropy)? Y/N; if N: a) Binary b) Base 10 c) Dice d) other
3) After cut -b, the hashed text length was: a) even, 2-16 b) even, 34-64 c) even, 66 or more d) odd
4) Did your cut -b range extend past the end of the string (hashed text shorter than the range width)? Y/N
5) Ignoring case and spelling: is the word before the space shorter (fewer letters) than the word after? Y/N
6) Ignoring case and spelling: is either of the two words exactly 3 letters long? Y/N

---

1) Y; 2) Y; 3) c; 4) N; 5) Y; 6) N.

---

Two short items, reply like: 1) b; 2) Y. 1) Your 09-26 "2.5E-32 of the 2^128 possibilities" looks like 2^23/2^128. What does your 2^23 count? a) cut -b ranges only; b) cut -b ranges x passphrase forms; c) cut -b ranges x something else about the text (case, ending, source, edits); d) a rough guess, not a count. 2) Is the passphrase a form of Hal Finney's name? Y/N

---

1) b; 2) Declined: no confirmation of candidates.

---

50k+1k: please send the 2 pubkeys Electrum-encrypted to this tx's input pubkey

---

Encrypted Q to bc1q7x7y key: QklFMQPYU2ctQXlfumfVoUPuabswSg51zLhKujRlDsHbTmPgjMDhX2UWPcKe4hk821HP7nkkaCsUDhIPoaucgS6VqBnL63AfnH+sVvcHHkkqNz3OuJwDjAc3sufr/Oj1N3NucILboQq8xdYha8xWU+cOvnjM1xgVaA+O9h+S2H43nQ+z7Gc3E7QRLCnY+lAFn0TRunV7gFUhcNcZt9iXHTeeER7N7iRkrhfyTwZCFHriG7xzk3wYJZsDV034UXCck86oP8RLhY2ooqaw+CDzVmOkck3F6zj3vZBBWvlzEY/yMpEFvg==

---

30k+1k: both BIP48 account numbers (m/48'/0'/acct'/2') for both cosigners, or both full key origins. Electrum-encrypt to this tx's input pubkey (also love the puzzle <3)

---

30k: both BIP48 account indices (or full key origins). Encrypt to input pubkey.

---

Encrypted Q to bc1qpcmr key: QklFMQIxTJpM6tSoOmrj5UCq+vZbRUzu4Z1OyaOi8R5NzstWpPK6CfN3aXNPsPRYwfMLRTCaFrFv8fspT+Q/NQ8okm47rvTzuSUd62G6wLeYDf36qVO76ohj+zU873AbzUI8fSizqrqolocD4NBL9RBweQmVmmy9BlDMY3SBudpcFJlN0ijRP+zpIxFN+4Wo8AZMxonzBGh+W++K+huChuVH3Y5P+qQOoz/6Hu3k7kfeLj82aw==Encrypted Q to bc1qsese key: QklFMQLKD6cJivk7i3482Wa5e19kUaZuh+pLqIYVShC/mTI9JO1FA3WUwkSRfauMm4K0qFE7t9kPWsp67wX5vi7IvzhNKgv1zqTvQamXVtNdINAPB+GXiTkd/ivA5GBCLrnMUbdWxqiETVnYRv11bFduXyejEIlGCzsgpflHUYuCCTSg5H2Af/A3johPXrng8maoo5SoQm+H0cuw3JB5etU/FrYrEgU/sTkHShyOjBpZ3ulQvA==

---

5k: What exact tr command did you use? Include options and operands, or NONE.

---

tr -d '\n'

---

Follow up on your 10-10 answer: 2^23 = cut ranges x passphrase forms Shape only, no name or values. Decline if needed, some might be too revealing :3
1) Number of passphrase forms counted: a) 1-32 b) 33-256 c) 257-4096 d) more
2) Number of cut ranges counted: a) under 2^15 b) 2^15 to 2^17 c) more than 2^17
3) Is each word's letter case one of: all lower, Capitalized, ALL UPPER? (y/n)
4) Typo in password?: (y/n)

---

1) a; 2) c; 3) Declined; 4) n.

---

7.5k+1k, shape only about the two BIP48 account numbers. No values, no indices, no paste, no PP spelling. Reply like: 1) Y; 2) a; 3) b; 4) N.
1) Were both account numbers obtained from the genesis block data WITHOUT any hashing? Y/N
2) The two account numbers come from: a) the SAME contiguous piece of genesis data b) two DIFFERENT pieces of genesis data c) one from genesis data, one chosen freely d) other
3) How were the genesis bytes turned into the account integer? a) hex digits read as a number b) decimal digits read as a number c) a byte offset or position d) a named field's raw value (version/time/bits/nonce) e) other
4) Is either of the two account numbers >= 4194304 (2^22)? Y/N

---

1) Y; 2) Declined; 3) d; 4) Y.

---

Encrypted Q to bc1qyas2 key: QklFMQII7HI6xq4ncU9UgYJyIvY+yiGXsy+W1ScYPR6zd4etsD279avPkyTMEDxnlAhR97Aq5ZUU/tSXXT6amXlApkEuqlPQcvz9wHzwaBnDhn/DRLrjPV7VwV6pthzX1OsMQFtRJsOoZBWUnlCes6SyR0xYpKu5vwpxohB09+uiT2yqtosn3DK9d2iheehO1OxSeqWDzmXdkma/p0qF66qB+LLqT0e9GvxH6jFEjR+w2H78HZiEX6VlMUzURj98TVUZCFp+OQiWU8UEdo8qrFNBg1+b8k/IRL14yGM74nLcyA5pJTU3fc8zTXbEC65dXwouTz9JJTndotrrvd8aB1f5mSX3bkmJjJ32xdoRkQv3y2VxgoTnHE42typaXrzb71q84qtppyT8N+qLNsHyU7+c+NTf2mtqHyX99GnDuhcI2viz0nqcG2MWOL7ei4IeLNbHLemtKTeCECln/0NkePaW/9A/a+nruM3UIHMa5WY7NkM2W6s7+Ueap7A3RPmlszt4TT97V/eKoWuro4Y8vjzqb3miHdB4+IV54ByKAnsy576UvgU2KMueUQE25C0BzYFOx4LqBYFuksF1IbDxb1Rf2KRPjkV0ltd36BzjBP2vddf7VQ20rJpTbV76Wg5cahH5xIBLj3iYuTIT4Shbampcez0IErd1JPVVqA5ToHTwtTHn9qdbQPQc+oR68JGCsC22ICtkqrfbx923dqaf4hQN8QF0IGfi/KzPbGKQ+NCz+TixXF+WM06C5YVB0TnSwMVNIKa3cXB24CsibufF1lrLblF0/1iVU64l6g+nLLBJsZjzFUC0Cyq8mS/Ml2WH2Ko1Up/LpMLRwshHgaVvKLHDAbwIj4odtNp/J3vmMu3QVECWLw+YJRG3bLQ2THLbsi4j726E8qocsdNymrcwGVX/Hbdq5DxwbAyW9ojoJUswL19FtaR+2VKi45JWg9crXXSdKToeGz/xKNqMNKIPtgQO9hEVXlnd2z93qf4bzOjatZb/ga+0vFLBTMNgqMLo8luceZk5Ukl/jsdQDqUd7WZwQdnG6EsrwEAPfbr3lU47HSq3QCDuwtH9oSe8dSmQOMcAvjuGZ/gYmqKX6IOyzNL3KLOJoOhmmScvU6ngTMquikNhXChVPy9rLeNF2TfbfdlHWekpn+Ec8/Bo+H5p0KnrJ0kSd4tdD9Z7bxElVtlxvkUEibdZg85Jack+MbK0eaccHsr+Czfvoe3LHnl8vmZqIoaxiR56FQvnokPMf78Hz7ykU30JgyahpiR4UGIC3jc2+CbiI3KxbdkmNLD/XNHRNJm6x5qp/SC1M0fLEID5ZHa2XsmQV5QglT5O3M3Gef5/hWCMmqyhy9SDDYpYIUC17rkHk5V9qX91wfiNyJf8HFQUldasygJbiusIGT1aLtE04fq4DOh2UgXVeqGGSfNjh0C+kqOVWEhA0nHIihQQccHE6qjkXEPdZfd40zCoNx5esInqqUoDhNa8Y+ubTifEMjEen1nD8CTlFME+FO9DzYhn47sMOwvkLt+0Y2XFq6tRXTl1wXV21V1x697OKs2xogQCivpsHRrusq5ZNRQVRt8YAFtK+Bmb62W9PI3l3ub18dZHOfGN7OtfVVEmksTaRk+Pau+qPxgB9FLC3lQ0itzDHBJ5ogCTwrYAs1afom8AmniqrIrVP0l3BmkUDDww8Fw22kJagiP3nqq2m61ntmKs5xA1ceXfvoh1ee6nl3vPT9KdaglNHRKY7bK6TKTWizQm+WcDMqDlqibNl9pHYxIL7A==

---

Encrypted Q to bc1qdu8m key: QklFMQP+qvMELeFZQ8vzghhRcPWFQ3j4AWqtXpOdUbSzEmm8UICsj4XwLzm5PeKQC0g8aNLXSvpQLBW70lVSXePDtPTJZ7e8Oo2bARNvIrweAms7fg==

---

10k prize + 1k reply. Small test vector for the procedure only for cosigner 0852014c Using the same data source and processing steps, but substituting 'cut -b 2-67' and BIP39 passphrase 'Test Example', what are 1) the first mnemonic word and 2) the resulting BIP32 master fingerprint? These are arbitrary test inputs; no actual puzzle cut, passphrase, seed, or account numbers are requested. Feel free to decline either part if needed.

---

10k, public test inputs only, no secrets. Your 10-16 reply c85bcea3 (cut -b 2-67, Test Example, 0852014c) does not match ANY standard pipeline we can build: one 570-char lowercase raw hex line gives d1642212 (no LF) or a9be51f9 (with LF). So one step differs. For that same 2-67 test run, please report:
1) first 40 chars of the exact text fed to sha256sum
2) its byte length (wc -c)
3) first 8 hex of the sha256sum output
4) exact command line(s) or tool steps, from source to sha256sum, with the cut range shown as 2-67
5) where the source text came from (URL/command) and how it was saved (file/paste/editor)
If any item would reveal a secret, answer the others.

---

1) Declined; 2) c85bcea3.

---

Declined. For a test vector with predefined inputs, I can only provide the final result. Step-level answers would be the same as uncovering the individual secrets one by one.

---

10k+1k. Test vectors with predefined inputs, final result only, as you offered. For cosigner 0852014c, run your own source and processing steps unchanged, substituting only the cut range below and BIP39 passphrase Test Example. Reply with the BIP32 master fingerprint for each:
1) cut -b 1-1
2) cut -b 2-2
3) cut -b 3-3
4) cut -b 1-4
5) cut -b 1-2000
6) cut -b 263-400
7) cut -b 1-66
Reply like: 1) xxxxxxxx; 2) ...

---

10k+1k. Test vectors with predefined inputs, final result only, same as your last answer. For cosigner 0852014c, use your own procedure and settings unchanged, except that the cut output is the literal text given below instead of a cut of the block, with BIP39 passphrase Test Example. Reply with the master fingerprint for each:
1) 0
2) 1
3) 000000000019d6689c08
Reply like: 1) xxxxxxxx; 2) ...; 3) ...

---

1) e4caa034; 2) 9fb54bad; 3) e4caa034; 4) e79c9765; 5) 8b9b2fea; 6) 68ab4226; 7) 9290f941.

---

1) e4caa034; 2) 9fb54bad; 3) 3bc42789.

---

Shoutout to the player who cracked the puzzle!

Thanks to everyone who joined in.

---

Thank you for the fascinating puzzle!

---

My GPU searched everywhere except the PBKDF2 settings. Well played!

---

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

              [ PUZZLE AUTHOR ]

  Handle : CaesarCoder
  GitHub : github.com/caesrcd

  PGP Fingerprint:
  E2A0 BF0D 72D7 4483 064D
  4FF9 3049 5240 7A6E 5C38

  "Every cipher tells a story.
   Every puzzle bears its creator's mark."

              -- CaesarCoder

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQS/k451MIi8XIQFhUUt5kqVkMnuzwUCatOdRQAKCRAt5kqVkMnu
z9wFAP46H2ajFiutbOQFwrJEZ34BKhzYeURvKES1XR/SRctyywD9GXCc+OTV2325
PMaeDBJCyz0dixlLWzQsncNpCPsU5gY=
=bm1s
-----END PGP SIGNATURE-----
Open the raw reconstruction ↗
text OP_RETURN ✓ Verified on-chain

The genesis-block puzzle — paid hints, solved on chain

Written to the chain on 22 Aug 2026, block 963,629.

Block
963,629
Written
22 Aug 2026
Size
27,358 B
Format
TEXT
Transactions
119

About this artifact

I made a Bitcoin puzzle using information contained in the genesis block created by Satoshi to generate the wallet. The entropy is extremely low. I didn't even need to back anything up. Everything I needed was already in the genesis block. Good luck!

On 22 August 2026 someone funded a two-key P2WSH wallet and announced in OP_RETURN that its keys came from the genesis block, with entropy 'extremely low'. A second message set the rules: send a transaction to the wallet with a question in OP_RETURN, get a hint in reply, and larger payments buy better hints. So every question paid into the prize. Over eight weeks the thread grew to 119 transactions. The prize grew from the author's 30,000 sats to 946,540 sats spread across 117 outputs. The answers mapped the puzzle's shape piece by piece: a 2-of-2 multisig on BIP48 paths; two 12-word BIP39 seeds, each made from the first 128 bits of a SHA-256 over a cut of the genesis block's raw hex; and a BIP39 passphrase that is a name, whose 'key question' is 'Who received the first transaction?'. The askers turned methodical. They priced Y/N batteries at 10,000 sats and offered 50,000 sats for the public keys, encrypted to their own key with Electrum's ECIES. One reported 1.8 million passphrases tested. Another asked for test vectors on made-up inputs. The author declined anything that would act as an oracle for one secret on its own. One participant said they were testing hypotheses with Claude and writing brute-force scripts with it. Encrypted questions and answers (base64 'QklFMQ…', Electrum BIE1) stay as ciphertext in the transcript and are not decrypted here. At block 971,803 (17 October 2026) the whole prize was swept in one transaction, 1c70c4745fad5bf891b9ee2a9f8b0b5cd3f328eb847eb09c9bebb92f5f7e900b, to bc1qdu8mh9qjtjhy89mvhmcgf66ul6ld92rdr6qzad. That address had been asking questions since block 966,966. It then tipped the author 10,000 sats with 'Thank you for the fascinating puzzle!'. A later spend from the wallet left only 'My GPU searched everywhere except the PBKDF2 settings. Well played!'. At block 971,886 the author signed off with a PGP-signed note giving the handle CaesarCoder. The signing key (…9590 C9EE CF) differs from the fingerprint printed in the note, so it may be a subkey, and the signature was not verified. Nothing on chain establishes who the solver is, or who wrote the GPU message. The crypto-economy.com source reports the original announcement. Transactions, heights, ordering and payload bytes were checked against the public chain through Esplora, up to block 972,122.

How it was stored

OP_RETURN explicitly marks an output as unspendable and lets it carry a small data payload. Unlike fake-address methods, it does not create a spendable-looking UTXO. That makes it the least deceptive standard way to place small data on-chain.

More about OP_RETURN
Proof · 119 transactions

Verified against the chain

Every byte shown here was read from these transactions. Open one in a block explorer to check it yourself.

Show all 119 transactions
Addresses
bc1qfkhx02v89u2qyyyljeczw6hu9sr437y44t7ae5yf09thrdukfqesnjg2wj · bc1qyas2lnfgzjh3lyl4vfhc68daedc890zn8yetaj
Sources
https://crypto-economy.com/anonymous-coder-hides-bitcoin-wallet-puzzle-in-satoshis-genesis-block/
File
Download the reconstruction