---
title: "Brainwallet puzzle, 0.04 BTC"
description: "Twelve trivia riddles typed into brainwallet.io as a passphrase and a salt. The 2017 rules and every published answer and how the record rebuilds the key"
canonical_url: "https://puzzles.agntn.dev/collections/trivia-brainwallet"
---
# Brainwallet puzzle, 0.04 BTC
> Twelve trivia riddles typed into brainwallet.io as a passphrase and a salt. The 2017 rules and every published answer and how the record rebuilds the key
Autumn 2017. r/bitcoinpuzzles is a ghost town. The [announcement](https://www.reddit.com/r/bitcoinpuzzles/comments/77g5h7/meta_new_puzzle_in_development_005_btc_eta_is/) literally opens with "All (5 of you)". Then [Kierkegaard_Soren](https://puzzles.agntn.dev/authors/kierkegaard-soren) decides to wake the place up with real money and twelve riddles that go absolutely everywhere. Patents, chess, freeways, WikiLeaks, ham. This one is a gem.
The plan was **0.05 BTC**, about $300. Bitcoin went up in the meantime, so on November 4 the [post](https://www.reddit.com/r/bitcoinpuzzles/comments/7asy51/brainwallet_puzzle_004_btc_reward/) went out with **0.04 BTC**. Six hours later the wallet was empty.
## How the trivia brainwallet works
### Ten answers in, two answers of salt
Every riddle gives one word or one number. Lowercase, no punctuation. Answers 1 to 10 go into brainwallet.io in order, one space between them. Answers 11 and 12 go into the salt field of the "generic" tab. Hit generate. Same address as in the post? You win.
Different address? Tough luck. The post says to check your spaces first, then your answers. That's the only feedback you get. Twelve answers, one wrong letter anywhere, and you're staring at a random address with no idea which riddle broke it. Brutal and kind of beautiful.
### Twelve riddles, twelve rabbit holes
The post promised trivia "from different corners of knowledge". It wasn't exaggerating. A few favorites:
- A row of hex bytes. Decode it and you get coordinates plus "what are they selling (hoosier street)". Furniture, it turns out.
- `sopranos.reframed.snubbed`. Three random words? No, a what3words address. In Mozambique.
- Half a Beyoncé album plus half a Law and Order actor. Lemonade and Ice-T, so an Arnold Palmer. His last US Open round fell on June 17, 1994, the day of the O.J. Simpson car chase. Add up the freeways from the chase: 611. Who even thinks of that?
- A patent from exactly 138 years before launch day. The refrigerator, 221222. Minus the area code of Dayton, Ohio, where the cash register got its patent the same day.
- Seven people in a line, a logic puzzle, then every letter of their names as numbers. The answer is 82 digits long. Good luck typing that without a typo.
- A chess game from 1834 and "name the non-Frenchman". McDonnell.
The best one is clue 6. "Multiply that result by the year I was born." Who's "I"? The handle is Kierkegaard_Soren, and Søren Kierkegaard was born in 1813. Nobody ever needed the real birthday of the person behind the account. Cheeky.
### What brainwallet.io does with it
Not one SHA-256 like the old brainwallets. The generic tab runs scrypt over the passphrase and the salt, `N = 2^18`, `r = 8`, `p = 1`, 32 bytes out. That output becomes 64 hex characters, and SHA-256 of those characters is the private key. Uncompressed P2PKH on top.
The site is dead, the code isn't. The Wayback Machine has [brainwallet.io from October 11, 2017](https://web.archive.org/web/20171011071719/https://brainwallet.io/), 24 days before launch. That file is byte for byte the one in [routman/brainwallet.io](https://github.com/routman/brainwallet.io) at commit `7c9ca3f`. And the hex step matters a lot. Hash the raw scrypt bytes instead, or take the compressed address, and you land somewhere else. Only the page's own reading hits the prize.
## Who solved the brainwallet puzzle
### Quantris, with a little help from brute force
The claim landed in block 493,125 at 02:05:31 UTC on November 5. Eleven seconds after that block's timestamp [Quantris](https://puzzles.agntn.dev/solvers/quantris) wrote "Claimed it :)" in the thread. Half the prize went to charity. The spend pays 0.019935 BTC to `1HB5XMLmzFVj8ALj6mfBsbifRoD4miY36v`, which Quantris named as WikiLeaks' donation address. So clue 9 was about WikiLeaks, and WikiLeaks got paid. Nice loop.
The author asked right away how they got number 12. And the answer is great. They didn't. Quantris "totally cheesed" it, trying even numbers in the salt until the address matched. Eleven answers right and the last one a small number? That's a few clicks. The real clue was a Twitter account, 2 hams for $20. Quantris had seen it years before and still didn't connect it. Happens to the best of us.
Forty-eight minutes after the claim came the full walkthrough. Every answer, in spoiler tags, most with the steps. The author thanked them for it. That comment is where every `answer` on the record comes from.
### Solved, not claimed
A claim plus a published solution is `solved` in this dataset. One funding in, one spend out, **5h 59m** from the post to the claim.
## Where the key on the record comes from
### Nobody ever printed it
Not the post, not the comments. No private key, no WIF. So the record rebuilds it. The winner's answers, lowercased and joined exactly the way the post says, go once through the recipe above. First try, straight onto `1E3NARnUX25UgMvZd5EZTutD9yVHTVGDNC`. The public key it derives is the same one the claim transaction exposed in its input. Can't ask for a better check than that.
Still, it's rebuilt, not quoted. That's what `.derived()` is for, so `puzzles show` never calls the key published.
```ts [src/collections/trivia-brainwallet.ts]
export const triviaBrainwalletRiddles = puzzle({
id: "trivia-brainwallet",
chain: "bitcoin",
address: "1E3NARnUX25UgMvZd5EZTutD9yVHTVGDNC",
sourceUrl: THREAD,
startedAt: "2017-11-04 20:05:55",
preGenesis: true,
status: Status.Solved,
pubkey: uncompressed("04e5a18d9449ea5ee3be007dfa5fc7d8...7b92bdf16fc"),
key: hex("eccf44b2a700e0149d67331f803ca4f68ba5793df7a4fbb75c3f7d0752faffd9")
.wif("5KcaZnDWjq8r8SjBPPefvGdYicv4aiQ1E7FR4SMa8CVZn6SSfEi")
.passphrase("furniture mozambique 611 electromagnetic eve 119658 220285 ...")
.salt("mcdonnell 20")
.derived(),
prize: 0.04,
});
```
`verify()` checks the hex against the address. It can't rerun scrypt, so the passphrase and the salt are there for you. Want to try it yourself? Go ahead.
### The money came first, by 94 seconds
The 0.04 BTC confirmed at 20:04:21 UTC. The post went up at 20:05:55. That's what `preGenesis: true` says: the address is older than the thread. `startedAt` is the thread's time, because that's when anyone could start.
### The thread lives in the repo too
Clues in a post, answers in a Reddit comment. Reddit forgets stuff. So the post, both edits and all 66 comments the 2023 capture still shows are kept as [an archived reading copy](https://github.com/agntn/puzzles/blob/main/assets/sources/trivia-brainwallet/kierkegaard-soren-2017-11-04.md), checked against that capture. The October announcement sits [right next to it](https://github.com/agntn/puzzles/blob/main/assets/sources/trivia-brainwallet/kierkegaard-soren-2017-10-19.md).
## The trivia brainwallet record
## Sitemap
See the full [sitemap](https://puzzles.agntn.dev/sitemap.md) for all pages.