GSMG.io puzzle

The puzzle

GSMG.io published an image, a rabbit hole of encoded phases behind it, and 5 BTC on an address whose public key was posted along with it. Nobody finished. The author took half back in 2020 and half of what was left in 2024. So the prize on the record is 1.25649674 BTC, the 1.25 that stayed plus what's left of a long trickle of small deposits. The transaction list has every one of them, and it says exactly where the other 3.75 went.

How the GSMG puzzle works, phase by phase

Five pieces, all of them still live on gsmg.io: three numbered phases, then SalPhaseIon and Cosmic Duality on a page you only find by hashing. The domain was renewed and every URL below answers, so this walks through the author's own pages, not archive captures.

Most of it is solved, and the answers have been public since 2019 and 2020. The community writeup that collects them is puzzlehunt/gsmgio-5btc-puzzle, started in April 2020 and last touched in May 2021. Everything below marked as checked was rerun against the copies in this repository: the image, both phase ciphertexts, the hashes and the decodes. What's still locked is at the end.

Phase 1: a grid with a rabbit in it

The picture at gsmg.io/puzzle

The entry point isn't even a page. https://gsmg.io/puzzle answers with a bare PNG, 1048 by 1556 pixels. The top is a 14 by 14 grid of black, white, blue and yellow squares with a pixel rabbit sitting in the middle. Below a red line comes the banner: GSMG.IO 5 BTC PUZZLE CHALLENGE, the logo, the prize address and a QR code.

That QR code is the first trap for anyone holding a phone. It scans fine and gives you the address on blockchain.com. Which you already had, printed right next to it. The grid is the puzzle, and the grid is not a QR code, however much it looks like one from across the room.

How to read the grid

Every square is a bit. Black and blue are 1, white and yellow are 0. Start in the top left corner and go counterclockwise in a spiral: down the left edge, along the bottom, up the right, back along the top, and inwards. 196 squares give 24 bytes and four spare bits, and the bytes spell:

gsmg.io/theseedisplanted

Checked, against the pixels and against the writeup's matrix. The rabbit sits on the four centre squares, which are the four spare bits, so they don't count. It also covers the edges of three squares in the ring around them. Those still show mostly white and read as 0. A 1 in any of them turns the end of the URL into junk like plantet or plan|ed.

The seed is planted

That URL is a tiny page. Eight small pictures in a row, one black, three blue and four red: a bank with a dollar sign and "war" under it, "CA", "dig i +", a closed lock over "lo", "crypto gic", "n you", an open lock over "n ing", and "t -". Words with pieces missing, rebus style.

Under them sits a password form you won't see. It's wrapped in display: none, so it only shows up in the page source or the dev tools. The form posts to /phase1verification, and that's how we know this page still counts as phase 1. There's also an HTML comment for whoever got this far: "Nice to see you around! Good luck little bunny hunter ;)"

The password is a song

Put the pictures back together and you get "war" plus "ning" and "lo" plus "gic". The Warning, by Logic. The writeup didn't always say so: its first version, from April 2020, named a different song, and the Logic reading came in March 2021. The password was in there from the start:

theflowerblossomsthroughwhatseemstobeaconcretesurface

Unhide the form, type it, submit. There's a nice receipt for this one too. On April 22, 2019, nine days after launch, somebody in GSMG's own Telegram support group was asked for "an hash of the answer" and posted this:

5ac407837447fba24ba2802e4d1e9aecb4580aa29fef1088cc387c180b746f75

That's the SHA-256 of the phrase above. Checked.

Phase 2: are you looking for the private keymaker?

The form sends you to a page whose path is a whole sentence with the spaces taken out, 94 letters of it: choice is an illusion created between those with power and those without, a very special dessert, I wrote it myself. Good luck typing that from memory. The comment in its source says "You made it to the next step! Good luck little bunny hunter ;)" and the page is headed PHASE 2.

The first ciphertext

It starts with a line in quotes, "1... are you looking for the private keymaker?", and goes on: "You come to me, without it. Come to me with it and you'll have the power to continue. It'll grant the first part." Then the page says how the blob is locked, "Ciphered with aes-256-cbc /w base64 sha-256(password)", and prints it. 14 lines of base64 starting with U2FsdGVk, which is OpenSSL's Salted__ header. So at least the format isn't a mystery.

The password is causality

The path gives it away if you've seen The Matrix Reloaded. "Choice is an illusion created between those with power and those without" is the Merovingian, and a few lines earlier in the same scene he names the one constant: causality. Hash the word, take the digest as lowercase hex, and hand that to OpenSSL as the password:

openssl enc -aes-256-cbc -d -a -md sha256 -in phase2.txt \
  -pass pass:eb3efb5151e6255994711fe8f2264427ceeebf88109e1d7fad5b0a8b6d07e5bf

Checked: 648 bytes of plaintext. Three ways to get bad decrypt instead, all checked too. Hash causality with a trailing newline, which is what echo and a text file give you. Write the digest in uppercase. Or leave out -md sha256 on an old OpenSSL that still derives the key with MD5.

What phase 2 decrypts to

The plaintext opens with "The ironic 2name of the keymakers trying to protect the current digital powers", drops a Mr. Robot episode title, and asks "Crypto finally to the latin 3Moon? Tell me, 4How so mate?". Then a row nobody has fully read yet, # X 2 S H 4 Y 0 Q B 15 #, with clues for four of its letters. The writeup reads S as a sum in Klingon numbers, 2 plus 5 times 6, so 32, and B as -16, built from the Intel part number of a Core i5. Even that B takes a bit of bending to get there. Q and H are still open, and so is what the row is for.

The numbered words are the useful part. 2name, 3Moon and 4How so mate point at a hardware security module, the Thales SafeNet Luna HSM. Those are parts 2, 3 and 4 of the phase 3 password, and causality was part 1.

Riddles, a chess board and a buddhist

Back on the page, after the blob, it stops being polite. One paragraph is about a guy who theorised that any linear electrical network can be swapped for a current source in parallel with a resistance, about his competition, and about the rulers of "a piece of land that's technically the poorest of the entire planet". It ends with "The 5binary code is a part of the piece of this puzzle." The next one has a chancellor awaiting banks to be bailed out, who "decided to write an anarchist digital answer to this worlds' misery".

Then a chess position in FEN:

B5KR/1r5B/6R1/2b1p1p1/2P1k1P1/1p2P2p/1P2P2P/3N1N2 w - - 0 1

And a question under it: "And now a buddhist is forced to move. What will be the next situation?" Between the pieces sit little tags like /(aaa, connected enf) and /(aBa, connected not enf).

Parts 5, 6 and 7

The theorem is Norton's. From there the writeup reads the rulers as US presidents: four named John, two Johnsons, and the one "with a number", John F. Kennedy. The order is Executive Order 11110, five digits that look binary, the one said to have tried to rein in the Federal Reserve. The writeup calls this stretch "a bit of a stretch" itself. Part 5 is 11110.

The chancellor is the headline in Bitcoin's genesis block. "Its' raw data after 4 on row 1616" is line 1616 of the original main.cpp, where the coinbase scriptSig is 486604799 4 0x736B…6854. Part 6 is the hex after the 4, 0x included.

Part 7 is the board after a buddhist move, one that doesn't give mate. The writeup calls it a fairly well known chess problem, and the answer is the next position in FEN, with Black to move:

B5KR/1r5B/2R5/2b1p1p1/2P1k1P1/1p2P2p/1P2P2P/3N1N2 b - - 0 1

The tags say how to write each part down. aBa keeps the case as it is. connected enf means no spaces, connected not enf means keep them, which is why the FEN goes in with its spaces.

Phase 3: the second blob

Seven parts and one hash

The last line of phase 2 is the only plain instruction on the whole site: "parts 1..7 --> sha-256 -> dgst is the password to enter Phase 3". Right below it, headed PHASE 3, sits the second blob. 86 lines of base64, about six times the first one, "also ciphered with aes-256-cbc /w base64". Same lock, bigger box.

Glue the seven parts together, causality, Safenet, Luna, HSM, 11110, the genesis hex and the FEN, and hash:

1a57c572caf3cf722e41f5f9cf99ffacff06728a43032dd44c481c77d2ec30d5

Checked: 4090 bytes of plaintext. One warning from experience. The blob's last line shares a line with the closing </textarea> in the HTML, so a copy that drops it decrypts fine right up to the end and then fails on padding. The copy here has all 86 lines.

Phase 3.1: three riddles

The plaintext starts with three riddles, each marked /(aa,connected enf), so lowercase and no spaces:

1. What if the Merovingian is wrong and something other than causality could be ours? "The future is ours to direct" is Jacque Fresco, so jacquefresco.
2. "How long is forever?" asks Alice, and the White Rabbit says "Sometimes, just one second". Add giveit in front, as the riddle says: giveitjustonesecond.
3. The fundamental limit to the precision of certain pairs of properties: heisenbergsuncertaintyprinciple.

Their SHA-256 opens the phase 3.2 blob that comes right after them. Checked: 2422 bytes.

250f37726d6862939f723edc4f993fde9d33c6004aab4f2203d9ee489d61ce4c

Phase 3.2: the Architect's speech

Phase 3.2 opens with the Architect from The Matrix Reloaded, "I've been waiting for you", and then hands over four things: a line of box drawing characters, a 149 digit number, a sentence about a king and a queen, and one more base64 blob.

A beautiful strategic position

"... am I here? Wake up, you..." is Neo's line with Neo swapped for you, and the puzzle keeps doing that. "I've designed you a beautiful strategic position. One for one, four for one." Beautiful points to the Beaufort cipher, and one, one, four, one is 1141, the IBM EBCDIC code page. Read the box characters as EBCDIC 1141, then run Beaufort with the key THEMATRIXHASYOU.

It's a long message, and it doesn't pull punches: "YOUR LIFE IS THE SUM OF A REMAINDER OF AN UNBALANCED EQUATION INHERENT TO THE PROGRAMMING OF THIS PUZZLE". It also says the last task needs "OVER TWENTY-THREE CIPHERS SIXTEEN ENCRYPTIONS AND OR SEVEN INTERTWINED PASSWORDS", and that brute force might be required. Checked, Beaufort included.

Code page 1141 without code page 1141

Neither Node nor Python ships 1141. Python does ship cp273, though, and 1141 is just 273 with the euro sign swapped in. So take the 1539 bytes OpenSSL gives you, read them as Windows-1252 and encode them with cp273. Out come the writeup's letters, all 1539 of them, starting with vtkvplmepphluwahtzmjp. Not one euro sign in there, so the swap never matters. Checked, and glibc's iconv, which does know IBM1141, gives the same letters.

The writeup had those letters and the speech from April 2020. Where the letters come from, the 1141 part, only showed up in March 2021. Who needs a reason when the key works?

A king, a queen and a checkerboard

"A fubcd-king & oracle-queen, thingky mvps, on a sad board but as wide as the first one seen." The words build a keyed alphabet, FUBCDORA.LETHINGKYMVPS.JQZXW, and the board is a VIC straddling checkerboard, with 1 and 4 as the blank columns. The 149 digit number decodes to:

IN CASE YOU MANAGE TO CRACK THIS THE PRIVATE KEYS BELONG TO HALF AND BETTER HALF AND THEY ALSO NEED FUNDS TO LIVE

Checked. Nice, but it's not a key. Two keys, the text says, and it doesn't say which.

The writeup's April 2020 version got there the long way. Plain alphabet on the board, then a substitution solver over the result. The keyed alphabet came in March 2021, same day as the 1141 reading.

The blob that's left

The last thing in phase 3.2 is another base64 blob, starting U2FsdGVkX1+0Wl49. That's Salted__, the header OpenSSL puts on what it encrypts, and it says nothing about the cipher. Phase 3.1 named aes-256-cbc for the blob this one came out of, not for this one. The writeup has no password for it.

SalPhaseIon and Cosmic Duality

The door in the first picture

Two later hints came from the creator, according to the writeup. One is a spot in Decentraland with an audio file. Split the stereo channels, invert one, mix back to mono, and the spectrogram says HASHTHETEXT. The other is a poem: "Go back to the first puzzle piece without further ado. It might have shown you only one door, beware that the rabbits nest may contain a whole lot more."

So hash the text on the first picture, the banner line and the address run together:

GSMGIO5BTCPUZZLECHALLENGE1GSMG1JC9wtdSwfwApgj2xcmJPAwx7prBe

Its SHA-256 is a page path. Checked, and the page is live:

https://gsmg.io/89727c598b9cd1cf8873f27cb7057f050645ddb6a7a157a110239ac0152f6a32

SalPhaseIon

One heading and one long line of spaced out letters, mostly a to i. Some of it gives in:

• Two stretches use only a and b. Read them as bits and they say matrixsumlist and enter.
• shabef shows up twice. sha stays as it is, and bef is 256 with a to i as the digits 1 to 9, the same digits the runs below use. Right next to it, in plain letters: "our first hint is your last command".
• Split on z, two runs use a to i and o. Read those as digits with o for 0, convert the number to hex, and you get lastwordsbeforearchichoice and thispassword.

All checked. Woven through the letters, one character at a time, is a base64 blob starting U2FsdGVkX186tYU0, the same OpenSSL header, with no cipher named anywhere on the page. The writeup has no password for that one either.

Cosmic Duality

The same page, second heading. A clean 28 line base64 blob, the OpenSSL header once more, and no words at all. The writeups stop here.

Is the GSMG puzzle solved?

No. The prize is still on the address, the 1.25 BTC the author left plus some dust, and the record says unsolved. Three blobs have no password in the writeup: the last one in phase 3.2, the one inside SalPhaseIon, and Cosmic Duality. People keep posting claims about them, and the r/bitcoinpuzzles thread from October 2019 is where most of that happens. Take what you read there as a claim until someone shows the plaintext.

What the records carry

export const gsmgPuzzle = puzzle({
  id: "gsmg",
  chain: "bitcoin",
  address: "1GSMG1JC9wtdSwfwApgj2xcmJPAwx7prBe",
  sourceUrl: "https://gsmg.io/puzzle",
  startedAt: "2019-04-13 16:32:40",
  pubkey: uncompressed(
    "04f4d1bbd91e65e2a019566a17574e97dae908b784b388891848007e4f55d5a4649c73d25fc5ed8fd7227cab0be4e576c0c6404db5aa546286563e4be12bf33559",
  ),
  prize: 1.25649674,
  transactions: [
    funding("73e4…ce02", "2019-04-13 16:32:40", 5),
    increase("a2d2…7a8b", "2020-03-24 01:08:49", 0.00000666),
    increase("a798…f383", "2020-05-11 20:02:50", 0.000007),
    decrease("2aa9…1b13", "2020-05-11 20:02:50", 2.5),
    // …
    decrease("88cd…9df3", "2024-04-24 21:47:27", 1.25),
    // … every later deposit, the last on 2026-10-13
  ],
  assets: assets({
    puzzle: "puzzle.png",
    hints: ["follow-the-white-rabbit.png"],
    sourceUrl: "https://gsmg.io/puzzle",
  }),
  stages: [
    stage(
      "phase 1",
      "A 14 by 14 grid of black, white, blue and yellow squares …",
      [
        artifact("puzzle image", "https://gsmg.io/puzzle", "puzzle.png"),
        artifact("the seed is planted", "https://gsmg.io/theseedisplanted"),
      ],
      answer("The grid read as bits …", `${WRITEUP}#1-httpsgsmgiopuzzle`, { date: "2020-04-26" }),
    ),
    stage("phase 2", "…", [artifact("ciphertext", CHOICE, "phase2.txt")], answer("causality …")),
    stage("phase 3", "…", [artifact("ciphertext", CHOICE, "phase3.txt")], answer("…")),
    stage("phase 3.2.1", "…", [artifact("ciphertext", CHOICE, "phase3.txt")], answer("…")),
    stage("phase 3.2.2", "…", [artifact("ciphertext", CHOICE, "phase3.txt")], answer("…")),
    stage("SalPhaseIon", "…", [artifact("letters and blob", SALPHASEION, "salphaseion.txt")]),
    stage("Cosmic Duality", "…", [artifact("ciphertext", SALPHASEION, "cosmic-duality.txt")]),
  ],
});

Two things to notice. decrease is a transaction type of its own: a partial withdrawal by the author, kept apart from claim and sweep, so a prize going down doesn't read as a solve. And the public key is uncompressed and known from the start, because the author posted it. The address is open to a discrete log attack the way bits puzzles only become after a spend. Nobody has one of those either.

Status

Open since 2019, and a singleton like Bitaps: the id is gsmg. The puzzle image and the rabbit hint are under assets/gsmg/: assetUrl() points at the image on GitHub, assetLinks() at every file.

The stages in the record are the five pieces above, plus two. Phase 3.2 hides two decodes, and each gets a stage of its own: phase 3.2.1 and phase 3.2.2. Each has one line of about for the tools, the pages it lives on, and for the five solved ones the published answer with the writeup as its source, pinned to one commit. Both phase 3.2 stages point at the phase 3 ciphertext, because that's where the author hid them. /puzzle serves the image byte for byte as the puzzle.png in the repository, CHOICE is the long phase 2 URL and SALPHASEION the hashed one. All four text pieces are copied under assets/gsmg/ exactly as the pages print them, in case the domain lapses again.

The record

The one puzzle in this collection, the way its page shows it.

puzzle({
  chain: "bitcoin",
  address: "1GSMG1JC9wtd…Awx7prBe",
})