AI
The Puzzle: A Decade-Old Bitcoin Challenge
In April 2014, an anonymous author under the name Spencer Lucas posted a puzzle book to Twitter and Reddit. The premise: solve 20 clues, each yielding one uppercase or lowercase letter (52 possible characters each). Combine them with a secret string sent to buyers by email, feed the result into a brain wallet tool, and extract the private key for an address holding one bitcoin. Buyers paid 0.01 bitcoin (about $4-5 at the time). The prize sat unclaimed for over 11 years.
Brain Wallets: Passphrase to Private Key
Brain wallets encode Bitcoin in a memorized passphrase. SHA256 of the phrase produces a 256-bit private key. Elliptic curve cryptography then derives a public key. Two more hash steps (SHA256 followed by RIPEMD-160, called Hash160) produce a 160-bit value. Add a version byte, checksum, and Base58 encoding to get the Bitcoin address. Change one character and every downstream value changes completely. Phrases like the first three paragraphs of The Great Gatsby have been stolen in seconds by tools like BrainFlare, introduced at DEF CON 23.
The Combinatorics of Brute Force
With 20 clues and 52 possible letters each, the full search space is 52^20. Gabay and Ashley solved 16 of the 20 with confidence. At 1.4 megahashes per second on CPU using BrainFlare, working from scratch would take 4.73 × 10^20 years, 10 orders of magnitude longer than the age of the universe. With 15 solved, the remaining space shrank to a 270-second run. Two clues were completely unknown, and at least one confident answer turned out to be wrong.
Building a Custom Hashcat Module
A Hashcat plugin has two parts: a module (C code on CPU) handling input/output format and a kernel (OpenCL code on GPU) with the cryptographic math. Gabay built module 1337 by chaining SHA256 from module 1400, secp256k1 elliptic curve operations, and RIPEMD-160 from module 28502. The hardest problem was digest size: too small caused constant seg faults. Wrong endianness produced silently incorrect results. Debugging GPU threads meant forcing single-threaded mode and tracing output with printf statements.
Cloud GPUs, $50, and the Final Crack
The module ran at 7,600 kilohashes per second, barely faster than 1,400 on CPU. Gabay rented 3080s on Vast.ai at $0.16 per hour, generated 105 mask combinations covering all rolling-unknown permutations, and distributed the search. Total cloud spend: roughly $50. The crack completed in 3 minutes. On December 13, 2024, Gabay disconnected from the internet, imported the private key, and swept one bitcoin. The final blocker was clue 20: an ambiguous puzzle where K was correct and Y had been assumed for 10 years.
Notable Quotes
a cool 20 billion hashes. No big deal. Joseph “stoppingcart” Gabay · ▶ 18:19
to be competent in OpenCL which I wasn’t Joseph “stoppingcart” Gabay · ▶ 27:01
Uh, the Joker doesn’t mess with the IRS. Joseph “stoppingcart” Gabay · ▶ 44:26
Key Takeaways
- A decade-old Bitcoin brain wallet puzzle yielded one bitcoin after building a custom GPU cracking tool.
- Brain wallets are cryptographically breakable: automated tools scan common passphrases in seconds, so avoid them.
- Hashcat’s plugin framework, a C module paired with an OpenCL kernel, supports custom GPU-accelerated hash algorithms.
- Cloud GPU rentals totaling roughly $50 made brute-forcing a small key space practical without dedicated hardware.
About the Speaker(s)
Joseph “stoppingcart” Gabay is a security researcher, hardware hacker, and robotics engineer with a focus on reverse engineering. At DEF CON 29, they presented DoS: Denial of Shopping, analyzing and exploiting shopping cart immobilization systems, and expanded that work at DEF CON 31. Their research integrates knowledge from multiple domains to understand system design and uncover vulnerabilities.