---
title: "RetiredCoder's mini-puzzles"
description: "Seven small puzzles RetiredCoder posted on Bitcointalk from 2024 to 2026. Four are built on a Bitcoin puzzle key the author already held and pay the Bitcoin Cash still sitting on that puzzle's address, three put 0.01 BTC on a fresh key."
canonical_url: "https://puzzles.agntn.dev/collections/mini"
---
# RetiredCoder's mini-puzzles

> Seven small puzzles RetiredCoder posted on Bitcointalk from 2024 to 2026. Four are built on a Bitcoin puzzle key the author already held and pay the Bitcoin Cash still sitting on that puzzle's address, three put 0.01 BTC on a fresh key.

In 2023 somebody emptied puzzles 120 and 125 of the [Bitcoin puzzle transaction](https://puzzles.agntn.dev/collections/bits) and said nothing. In September 2024, 130 went the same way. A few weeks later a fresh Bitcointalk account called [RetiredCoder](https://puzzles.agntn.dev/authors/retired-coder) started posting mini-puzzles, one a month, each opening with "Guys, I'm bored today". The trick is where the prize was. Those addresses got their first coins before the August 2017 fork, so the same keys still unlocked a copy on Bitcoin Cash. Whoever holds the key to the BTC side holds the BCH side too. RetiredCoder had three such keys and gave the BCH away through riddles.

Then the keys ran out, and the riddles didn't. #4, #5 and #6 put 0.01 BTC on a key made just for the puzzle, each one a small lesson in cutting a key search down to size. In July 2026 RetiredCoder took puzzle 135 and quit the race. The next day came #7, the BCH of 135, and with it the key of 135 itself. Every thread links the one before, so the series is one chain of seven.

<collection-facts collection="mini">



</collection-facts>

## How the seven mini-puzzles work

### #1: three characters swapped, puzzle 120

[October 14, 2024](https://bitcointalk.org/index.php?topic=5513047), 13:48 UTC. The post prints the private key of puzzle 120, with "three characters changed randomly":

```text
0xB50F22572A497A836EA18AF2E1FC23
```

That's 30 hex characters, three of them wrong. Pick three positions, try every other hex digit in each and compare with something you already know about puzzle 120. kTimesG counted almost 14 million variants and asked how anyone checks the balance of all of them. You don't. RetiredCoder, blunt as usual: "If you don't know what is puzzle #120 and its address, well, you are out of the game." The public key of 120 has been on chain since 2019, so you compare pubkeys and never touch an explorer. "Correct, pubkey is the fastest way."

The real key is `b10f22572c497a836ea187f2e1fc23`. Positions 1, 9 and 21 were changed: `5` for `1`, `A` for `C`, `A` for `7`. The prize moved at 18:33 UTC. sneeky777 said "solved it in 3 mins" twelve minutes later and posted the key at 18:59. That was also the first time anybody saw the key of puzzle 120, over a year and a half after its BTC was taken.

### #2: twelve pieces, puzzle 125

[November 14](https://bitcointalk.org/index.php?topic=5518896), same opener. "The key fell and shattered into 12 pieces":

```text
804 E09 77 1C5 225 AC 960 33B 7F0 E4 6BB 48
```

Twelve pieces is 479,001,600 orders. But a 125-bit key starts with `1`, and only one piece does, so it's 11! and about 40 million. Nothing for a laptop. It fell in under two hours: `1C5 33B 6BB 7F0 804 E09 960 225 E4 48 77 AC`, so `1c533b6bb7f0804e09960225e44877ac`. The loudest reaction came later, from someone who missed it: "What an easy puzzle". RetiredCoder shrugged. They're mini-puzzles, meant for "everyone with minimal skills", and if you want hard ones, there's #67 and #135.

### #3: one signature too many, puzzle 130

[December 14](https://bitcointalk.org/index.php?topic=5522785), and this time "a bit more challenging". One message, one signature, both from the address of puzzle 130:

```text
Message: Anything one man can imagine, other men can make real
Signature: IIONt3uYHbMh+vUnqDBGHP2gGu1Q2Fw0WnsKj05eT9P8KI2kGgPniiPirCd5IeLRnRdxeiehDxxsyn/VujUaX8o=
```

The thread ran four pages. First "a hint is in the message". Then "you should have some understanding of ECDSA signature vulnerabilities". Etar checked a weak nonce in 80 bits and found nothing. "Same K or weak K would be too easy." A day later, "don't take anything from the blockchain". A minute after that the thread saw the prize move, and the claim confirmed at 17:21 UTC. The winner never said a word, so the author [explained it](https://bitcointalk.org/index.php?topic=5522785.msg64850761#msg64850761) instead.

The message is where the 80 comes from, the explanation says. The quote is usually credited to Jules Verne, so *Around the World in 80 Days*, we guess. Look for a weak nonce K1 in 80 bits, fail. Now remember RetiredCoder had posted another signature from the same key earlier. Its nonce K2 isn't weak either. But the two nonces sit close together. Each signature carries its R point, R1 = K1·G and R2 = K2·G, so R1 − R2 is (K1 − K2)·G. That difference is small, so kangaroos find it in the same 80-bit range. With the delta known, two signatures and one linear equation give the private key:

```text
pk = (delta_k·s1·s2 + z2·s1 − z1·s2) / (r1·s2 − r2·s1) mod n
```

Etar posted the numbers that evening: delta `0x22175083b1fc19218d84`, and the key, `33e7665705359f04f28b88cf897c603c9`. Puzzle 130's own key again. The steps we could rerun without the first message all check out. The signature verifies against the pubkey of 130. The nonce it implies gives R2 = `03838db7…`. Adding the delta gives exactly the `03de9709…` Etar quoted as R1. And the delta has 78 bits, inside the 80 the hint promised. The first signature's text isn't in the thread, so z1 is the one step we couldn't redo.

### #4: a point one step behind itself

[January 14, 2025](https://bitcointalk.org/index.php?topic=5526453), 17:22 UTC. No more puzzle keys to give away, so this time it's a public key made for the occasion, with 0.01 BTC on its address:

```text
03C8F139DAD58B4786D3649992849733C2A7626F011089E87508CCDF8B0758C493
Hint: It's a strong point so you cannot solve it by kangaroos. But it's a special point, you can solve it easily if you use some feature of secp256k1.
```

"You don't even need GPUs or fast PC." And probably no ECDSA, that was the last one. iceland2k14 went through what it isn't: no endomorphism image below 53 bits, none near a bit boundary, none a hash of the title. The prize moved at 08:41 UTC the next morning, and an hour later ukn9977 posted the answer as a Sage one-liner: `k = k*LAMBDA+1`.

The feature is the endomorphism. secp256k1 has a λ where λ·P is just (β·x, y), so the same Y. RetiredCoder picked the key whose λ image is the point right before it, P − G. "It's funny to have two points next to each other with same Y, isn't it?" Write λ·k = k − 1 and solve for k:

```text
k = 1 / (1 − λ) mod n
```

iceland2k14 ran exactly that and got `c6768f199574104ae1b75eab82b0cc1d2d2e9ee7d50637a574e27131e9301552`. "Correct!" We checked both halves: λ·k equals k − 1 mod n, and k gives the posted public key. kTimesG then argued for half a page that consecutive keys aren't neighbouring points. RetiredCoder's answer: "You are much more of a nerd than I am."

### #5: one number, four times

[April 16, 2025](https://bitcointalk.org/index.php?topic=5538285), 08:03 UTC. Another public key, another 0.01 BTC:

```text
03150992937967192EBCD2539E5A949689AC69E6458F9178E7251356FFE079B7F0
Hint: private key is ABCD
where A (lowest bits of privkey) - some 64bit value
B = 2*A
C = 3*A
D = 4*A
```

So the key is A times one fixed number, `1 | 2<<64 | 3<<128 | 4<<192`. Divide the public key by that number and you have a point whose key fits in 64 bits. That's a job for kangaroos or baby step giant step, not for luck. The prize left at 10:39 UTC.

The thread got two keys. HardFireMiner posted one at 11:29 that follows the pattern with A on top instead of the bottom. It doesn't match the public key. LeTH3knXoDArzm said "Solved it!" four minutes later and wrote the method up two hours later: invert the scale, multiply the public key, and BSGS on a PC they called a toast found A = `3380374721080fff` in two minutes, then four copies make `ce00dd1c84203ffc9a80a5d563182ffd67006e8e42101ffe3380374721080fff`. RetiredCoder: "Correct! We just need to use Scale". That key gives the posted public key, and its four words are A, 2A, 3A and 4A.

### #6: two holes

[March 14, 2026](https://bitcointalk.org/index.php?topic=5577390), 17:14 UTC, almost a year later. A public key, 0.01 BTC, and the key itself with twenty characters missing:

```text
03BBF1AFF1B753DFA4C58835C2C135D7D2C7CEA8635D483D37A8997B666CC1FA61
Hint: private key is 1BA27FB025xxxxxxxxxx6F34348EE6B14E9D8A3581C0B01xxxxxxxxxxA90D587
```

Two gaps of ten hex characters, 80 bits together. Too much for brute force, and kangaroos want one range, not two. The claim went through at 20:47 UTC. Two minutes later Ykra showed up, "just want to confirm I got this", having seen the thread twenty minutes before. roostam.aksenov posted the key at 22:35, `1ba27fb025baf482573f6f34348ee6b14e9d8a3581c0b018dbecc642fa90d587`, with notes from a kangaroo run modified for two gaps, about 15 minutes. We checked it: every one of the 44 printed characters matches, and the key gives the public key.

The funny part is the timing. The next morning RetiredCoder just linked a post: "kangaroos can be used easily for cases like this". That [post](https://bitcointalk.org/index.php?topic=5517607.msg66508168#msg66508168), in the RCKangaroo thread, went up at 13:34 UTC the same day, less than four hours before the puzzle. Split the jump table into one group per gap, so every jump stays inside its own hole. The recipe was public before the question was.

### #7: a nonce from the genesis block, puzzle 135

[July 29, 2026](https://bitcointalk.org/index.php?topic=5589799), 15:40 UTC. The day before, RetiredCoder took the 13.5 BTC of puzzle 135 and quit the race. Then one more for the road, the BCH of 135, "about 280$":

```text
16RGFo6hjq9ym6Pj7N5H7L1NR1rVPJyw2v
Thank you Satoshi Nakamoto!
ICVZGMwpPuca4krotcpwEzTyJXBUQF+w25M2TLnFHzIiAKYS+4c6taNLaMM7ZChJ2oMPQXiuzsYDCeF9xZFBMZg=
```

An address, a message, a signature. 77 minutes later the BCH moved, and the thread was all "Solved .. How ?". Nobody said. So at 20:07 the author did: "somebody quickly solved it and did not write here the solution. It's not polite". The message thanks Satoshi, so the hint is Satoshi's first block. The nonce of the signature is the genesis block's merkle root. Know the nonce and one signature gives the key:

```text
k  = 4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b
pk = (s·k − z) / r mod n
```

Then the key of 135, in the same post: `6d9392a16883f90903d5f78da57af07eb2`. We reran all of it. The signature verifies against the public key of 135. The merkle root, in the byte order explorers print it, gives exactly the r of the signature. And the formula gives the key the author printed. Reverse the bytes and none of that works.

## Where the Bitcoin Cash came from

Four of the seven pay in BCH: #1, #2, #3 and #7, on the addresses of puzzles 120, 125, 130 and 135. All four got their first coins in the 2015 transaction and the big top up of July 11, 2017. Both happened before the fork on August 1, 2017, so both exist on Bitcoin Cash too. The later BTC deposits don't, not even the 12.15 BTC that went to 135 in 2023. That's why the prizes are 1.2, 1.25, 1.3 and 1.35 BCH, each puzzle number over a hundred. The same copies sit on Bitcoin SV and Bitcoin Gold. For #130, [privatekeys.pw](https://privatekeys.pw/puzzles/mini-puzzle-for-puzzle-130) lists the prize as "1.3 BCH, BSV, BTG". Those chains stay out of the records until this library can read them.

## What the mini records carry

```ts [src/collections/mini/3.ts]
export const mini3 = puzzle({
  id: "mini/3",
  chain: "bitcoincash",
  address: p2pkh("bitcoincash:qz3yjg59ypg6jqpwhaxgvjj44jm4hdx0w5wsxw2qez", "a2492285…b4cf75"),
  sourceUrl: "https://bitcointalk.org/index.php?topic=5522785",
  startedAt: "2024-12-14 16:22:32",
  status: Status.Solved,
  pubkey: compressed("03633cbe3ec02b9401c5effa144c5b4d22f87940259634858fc7e59b1c09937852"),
  key: hex("000000000000000000000000000000033e7665705359f04f28b88cf897c603c9", 130),
  prize: 1.3,
  hints: [/* the message and signature with the author's explanation, then four hints */],
  solvedAt: "2024-12-15 17:21:10",
  solveTime: 89_918,
  transactions: [funding(/* 2015 */), increase(/* 2017 */), claim(/* 2024 */)],
  solver: party(undefined, {
    addresses: ["bitcoincash:qrda29v338en6lkt5s8mv3wls0l778qg0sdxk42358"],
  }),
});
```

#4, #5 and #6 are plain Bitcoin records: a 1-address, 0.01 BTC, one funding and one claim, both a few minutes to a day from the post.

### The same key twice

`mini/3` and [`bits/130`](https://puzzles.agntn.dev/collections/bits/130) share a key, a public key and a HASH160. They're still two puzzles. One was 13 BTC and fell in September 2024. The other was 1.3 BCH and fell in December. Different chain, different prize, different claim. The CashAddr and the 1-address are just two spellings of the same hash. `mini/7` and [`bits/135`](https://puzzles.agntn.dev/collections/bits/135) are the same story, a day apart.

### Addresses nobody printed

None of the posts prints a CashAddr. #1 to #3 name the puzzle and say the BCH is there, #7 prints the 1-address of 135. The records take the HASH160 of the `bits` address and spell it the Bitcoin Cash way. For #130, privatekeys.pw prints the same address. For all four, the chain agrees: the prize leaves each address within a day and a half of its post, and nothing big leaves it before.

#4 to #6 print only a public key. The address is its compressed 1-address, which somebody in each thread printed, and the chain backs it up: 0.01 BTC arrives minutes before the post, and the claim spends it with that same public key.

### Solvers with an address and no name

sneeky777 said they solved #120 in three minutes and posted a signature. It doesn't recover to the address the prize went to, not with any text we could read into their post. iceland2k14 said "Got it" three minutes after the #125 claim, and nobody tied a name to the #130 claim at all. LeTH3knXoDArzm said "Solved it!" after the #5 claim and got the author's congratulations, but nothing links them to the address the prize went to. Ykra wrote "just want to confirm I got this" two minutes after the #6 claim and never came back. #4 and #7 had no claimant at all. So each record keeps the claim's output address and no name. RetiredCoder, "congrats to the winner (though he did not appear), done!"

### Numbered like the author numbered them

`mini/3` resolves as `3`, `"3"` or `mini/3`. The first three threads are titled "Mini-puzzle for puzzle #130" and so on, but from #4 on the titles are just "Mini-puzzle #4", and #4 to #6 have no Bitcoin puzzle behind them. The count is RetiredCoder's own, so the identifiers follow it. The first records were keyed by the puzzle number, as `mini/120`, `mini/125` and `mini/130`. Those are now `mini/1`, `mini/2` and `mini/3`.

## The mini-puzzle records

<collection-puzzles collection="mini">



</collection-puzzles>


## Sitemap

See the full [sitemap](https://puzzles.agntn.dev/sitemap.md) for all pages.