Genesis Block Wallet Puzzle

The Genesis Block Wallet Puzzle is a Bitcoin challenge announced on August 22, 2026 and solved on October 17. Its creator said everything needed to generate the wallet was in Bitcoin's first block. Public data. Extremely low entropy. No backup needed.

All true, as it turned out. Then the hints said there were two keys, and you need both. Nice little catch. And the real catch came last.

Two keys and a very old block

The announcement sits in an OP_RETURN output in block 963629. That's a message written into a Bitcoin transaction, not a private conversation or a disappearing post.

The target is a P2WSH address:

bc1qfkhx02v89u2qyyyljeczw6hu9sr437y44t7ae5yf09thrdukfqesnjg2wj

According to the replies, the wallet uses a 2-of-2 multisig. Both keys come from the same Genesis block field. Later clues mention BIP39 with twelve words and a passphrase, followed by BIP48. So the puzzle points back to 2009, but the wallet uses much newer conventions.

The author offered the two public keys for 50k sats from September 17. The September 24 terms added 1k to the author's address and delivered the keys encrypted to the buyer. Bought, not published. The sweep published them anyway, in the witness.

How the Genesis puzzle was solved

The recipe is in Schum's pull request to floflo777's catalogue, opened less than three hours after the sweep. We ran it on the block bytes. It lands on the address exactly.

1. Take the raw block hex, all 570 lowercase characters, and cut -b 263-400. That's the coinbase text, The Times 03/Jan/2009 Chancellor on brink of second bailout for banks, still as hex.
2. Run sha256sum on those 138 characters with no newline. The first 32 hex digits, c020f55f60b8193bd5cac836769dbf76, go into Ian Coleman's tool as Hex entropy.
3. Out come twelve words: scan amateur fit scrap light over fire flip cushion reject hurt ugly.
4. The passphrase is Satoshi Nakamoto. Who received the first transaction? Hal Finney, sure. But the Genesis coinbase pays Satoshi.
5. Now the twist. The seed isn't BIP39's 2048 rounds of PBKDF2. One cosigner takes 181505 rounds, the other 200913. That's 18:15:05, the Genesis block time, and 2009/1/3, its date. One phrase, two seeds, master fingerprints 0852014c and 040e2791.
6. Both keys sit at m/48'/0'/1231006505'/2'/0/0. The account number is the block's Unix timestamp. Sorted into a 2-of-2 script, they hash to the address.

So the text and the passphrase were sitting inside the standard searches all along. Every brute force at 2048 rounds walked right past them. "Everything I needed was already in the genesis block" holds up. Even the round counts are in there.

The record keeps the recipe twice. Once as the announcement's published answer, with its source and date. And once as the key: two seeds with their round counts, plus the witness script the sweep revealed.

puzzles verify genesis runs both seeds, rebuilds the 2-of-2 and lands on the address. About a second of PBKDF2. Eight weeks, for everyone who stayed at 2048.

The test vectors that gave it away

On October 6 a player asked the author to run the pipeline on a made-up input: 000000000019d6689c08 with Test Example. The answer was host and b7f4182b. That's what standard BIP39 gives.

On October 17, at 01:34 UTC, the same literal came back as 3bc42789. Same text, same passphrase, "your own procedure and settings unchanged". That's what 181505 rounds give. Two answers for one input, and the difference is the secret. The sweep came two hours later.

The day before, the author had also answered seven cut -b ranges for cosigner 0852014c. Range six was 263-400. The real cut, served as a test vector, under a fake passphrase. Bold.

All ten fingerprints from October 16 and 17 reproduce at 181505 rounds. One more doesn't. On October 16 the author put cut -b 2-67 at c85bcea3, and the recipe gives d463151e. floflo777 called it an author slip. The record keeps the author's answer and doesn't pick.

Who swept the Genesis puzzle wallet?

Schum, by the record. The sweep in block 971803 spent all 117 outputs, 946,540 sats, and paid 935,266 to bc1qdu8mh9qjtjhy89mvhmcgf66ul6ld92rdr6qzad.

That address wasn't a stranger to the puzzle:

• September 14: it asked what the passphrase was made of.
• September 24: it paid 50k for the encrypted public keys.
• October 17, an hour after the sweep: the author posted a shoutout to the player who cracked it.
• An hour after that: the address sent the author 10k with "Thank you for the fascinating puzzle!". Cute.

Less than three hours after the sweep, Schum published the recipe, and floflo777 credits the solution to the same account. Nothing signed ties the coins to the GitHub account. The record puts the two together anyway, as its own call, and the solver page shows what that call rests on.

Two small spends followed. At 10:29 UTC someone holding the keys spent the 680 sats that arrived after the sweep. All of it went on fees, with "My GPU searched everywhere except the PBKDF2 settings. Well played!". Painfully honest.

Then the 400 sats the author's signed message dropped on the address went too. With the recipe public, anyone could. Both spends stay in the record, so puzzles watch doesn't report them as unknown.

Genesis puzzle hints in OP_RETURN, not answers

The record keeps every public reply through October 17, 2026. With the announcement that's 45 hints. Some narrow the puzzle. Others explain how to buy another hint. Bitcoin support tickets, apparently.

August and September: the shape

• The Genesis field: both keys use the same field and are derived independently.
• The newspaper: The Times can stand in for the Genesis block.
• The wallet format: BIP39, twelve words, a passphrase and a BIP48 account number drawn from Genesis data.
• The passphrase: who received the first transaction? Later the author says it's a name.
• The entropy: a 128-bit digest. On September 24, spelled out: the first 128 bits of a SHA-256 hash.
• The hashed input: a contiguous piece of the block, pasted exactly as a standard tool prints it.
• The toolchain: bitcoin-cli, cut, jq, tr, sha256sum, iancoleman/bip39 and OogaBoogaX/entropylab. Pasted from bitcoin-cli and an explorer. Plus a warning that the rest takes brute force.
• The pipeline: jq, cut and tr changed the text before sha256sum. The first 32 hex of the digest went in as raw entropy.
• All at once: no master fingerprint, no short hashes of the passphrase or the words. Every secret gets cracked at the same time, or not at all.
• The cut: hex, cut out of a tool's field, no trailing newline.

October: the cut and the names

• The size: even, more than 16 characters, at most 32, the same for both cosigners. The knife was cut -b.
• The source: not the raw getblock 0 hex, just "genesis block". Thanks, that narrows it right down.
• One cosigner by name: 0852014c is the master fingerprint with the passphrase applied. Its entropy went into Ian Coleman's tool as Hex.
• The path: both keys sit at m/48h/0h/Xh/2h/c/i with small indexes.
• The spaces: ASCII letters and spaces only. How many spaces? The answer was ¬_¬.
• Two names: two words, one space, each a given name or surname of whoever received the first transaction.
• The field: not a clean run of 18 to 32 hex digits. One of the block's fields with its length, case or ending changed.
• A test run: 000000000019d6689c08 with Test Example gave host and b7f4182b. Standard BIP39 gives the same. So the recipe looked boring. It wasn't, see above.
• Where the line came from: an explorer page or API, out of the raw block hex. The cut didn't start at byte 1.
• Straight off mempool.space: copied from the page in a browser, one unbroken run of 570 lowercase characters. The hashed text is even and 66 characters or longer.

October 9 to 17: the last questions

• The other cosigner: 040e2791 uses the same hex and the same Hex entropy. The passphrase's first word is shorter than the second, and no word has three letters. Satoshi, seven. Nakamoto, eight.
• What 2^23 counts: cut ranges times passphrase forms. Up to 32 forms, more than 2^17 ranges.
• Hal Finney? Declined, no confirmation of candidates.
• The tr: three words. tr -d '\n'.
• The account numbers: straight from Genesis data, no hashing, a named header field's raw value. Both turned out to be the timestamp, 1231006505.
• Final results only: fingerprints for test vectors, nothing step by step. The fingerprints did it anyway.

Wait, wasn't an earlier answer "there is no hash"? Yes, on August 24. A month later the author named SHA-256 outright. Both messages stay in the record. Smoothing that away would make the story cleaner and the evidence worse.

Same with the copy and paste. On September 25 the input was a piece of the block exactly as a tool shows it. Two days later the author said N to "exactly tool copy-paste ASCII". Pasted, then trimmed, fits both. The recipe settles it: the cut was the coinbase text, as hex.

And the length? On October 1 the cut was at most 32 characters. On October 6 the hashed text fell outside 18 to 32. On October 7 it was 66 or more. The real one has 138. So much for 32. The record keeps every answer and doesn't pick.

Read the full texts with their dates and transaction links:

puzzles hints genesis

Replies you can't read

From September 24 some of the author's messages are encrypted. They sit in OP_RETURN as base64 starting with QklFMQ, which decodes to BIE1, Electrum's message encryption. Each one opens only for the player whose key it was encrypted to.

One of them, on October 16, went to the address that swept the wallet the next morning. What did it say? Only that address knows.

The author's X account made that a sales pitch on October 6. Who wants the two public keys? The encrypted ones are already on chain, it says. True. They open for the player who paid, though, not for whoever squints hardest.

Some messages quote a player's decrypted offer before the author's answer, like the September 26 one. Only the author's part after "Reason for decline:" is recorded.

Player questions stay out too, even the answered ones. Some answers are only letters, like 1) a; 2) b., so each hint's note says which question it answers.

How much was the Genesis puzzle prize?

The address took 947,620 sats in 120 outputs over eight weeks. Every paid question added to it. The sweep moved 946,540 of them, and that's the prize in the record. The rest arrived after the sweep and went in the two small spends.

The start date is the announcement's block timestamp. The record includes the initial 20,000-satoshi funding, the announcement's 5,000-satoshi deposit, the sweep and the two spends after it, not every hint payment in between. preGenesis marks that earlier funding.

puzzles show genesis
puzzles watch genesis

Sources behind the Genesis puzzle clues

floflo777's folder for the puzzle collects the dialogue, research, the solution and tools/verify_solution.py. Its author-posts transcript explains how the replies connect through change outputs.

Every message here was checked against confirmed transaction bytes. Earlier replies spend change outputs linked back to the announcement. From the September 19 message on, the replies come from the announcement's input address again. The September 27 and 28 answers go one better: each spends the 1k the question paid to that address, so the answer is chained to its question.

On October 15 the author split that address into 25 outputs of 569 sats. The last five answers and the shoutout come from fresh addresses those outputs funded. New address, same wallet. Each hint carries that evidence. Player questions, including relayed ones, are not quietly promoted to author hints.

Galaxy Research reported the announcement. crypto.news and U.Today covered it on August 23. Useful context, but the transactions are the source for the actual clues.

A singleton id, no name segment

genesis is the whole identifier, like gsmg and the other singletons. It used to be genesis/block, a name segment for a collection that only ever held one puzzle. The old page redirects here.

The Genesis Block Wallet Puzzle record

puzzle({
  chain: "bitcoin",
  address: p2wsh("bc1qfkhx02v8…esnjg2wj", "5221027b497b…2ec152ae"),
  status: Status.Solved,
  key: cosigners(seed("scan amateur…urt ugly", "m/48'/0'/123…'/2'/0/0", "Satoshi Nakamoto").rounds(181505), seed("scan amateur…urt ugly", "m/48'/0'/123…'/2'/0/0", "Satoshi Nakamoto").rounds(200913)),
})