The Bitcoin Treasure Hunt is a puzzle with 10 questions, including some programming challenges. The prize is 0.0128 BTC (worth around $100 USD.)

If you get all of the answers correct, the result is the private key for this Bitcoin address: 1FormAP1qhonAfJToRfYZG9QtNeMFxsurL

Someone has solved the puzzle!

Here’s the winner’s transaction. They would like to stay anonymous, but they sent us the following message:

Here's a signed message as proof:

(https://tools.bitcoin.com/verify-message/)



=== Message (next line only) ===

Thanks for the puzzle! See extended comments here: https://pastebin.com/raw/7XV4Mh1J

===

Address: 16oDLoLtCfA3oP4cpHHMVpZG8HTv7ig8PU

Signature: H3rL+u4j82shZQ1aTNidsDL6+KC3MTR57xx5vZYb7EV/EnhGVYC0laYkeKdtoXVEI28hrC5mhhBn5i/uV8lFST0=



Well done, and thanks for the awesome feedback! We’ve updated the puzzle with your notes.

We’re going to leave the puzzle online, so you can still try to solve it. If you get stuck, there are some hints in the winner’s comments on Pastebin. (They don’t give too much away.)

We’ve also published a blog post with the answers, and a GitHub repo with the code.

Before you get started, make sure you know how to import a private key. We recommend using Coinb.in or Electrum.

The Puzzle

What country’s name is an anagram for the opposite of digital (all lowercase)? What is the SHA256 hash embedded with OP_RETURN in this transaction?

bf063d6eb817db2f810f5b552bc3cd8c568b9c43a31c98cda2fcbef4fb7865d6 What was the “Block Hash” for this transaction?

09e95d36f05b8faca606f920a029d29007cc1dcb35fb540f8ed62f8457630bb6 Concatenate the first names of all U.S. Presidents in alphabetical order, and all lowercase. Calculate the SHA256 hash of this string.

— Note: grover should be included twice, and the first four characters of the hash are: c3bd . We used a fair dice roll to choose a random number between 1 and 6. What was the number? Find the 53-character hex string hidden as an HTML comment in the DocSpring documentation. Find the string matching /^[0-9a-f]{6}$/ , where the SHA256 hash of that string starts with itself. Then:

Visit the website at https://www.<string>.com

Answer the question on that page.

Fill in this form with the correct values, then download the PDF. Calculate the SHA256 hash of the PDF. (UPDATE: This code has now been removed from the application, so this question does not work any more.) Go back to the website from Question 7. Something happens to the page whenever you press a certain key 3 times in a row. If you can figure out why that’s happening, you’ll find the answer to this question.

— Note: Make sure you enable JavaScript, and disable any extensions like uMatrix. Visit the formapi-ruby project on GitHub. Find the hash of the latest git commit.

Generate the Private Key

Concatenate answers 1 through 10 into a single string

Calculate the SHA256 hash of that string, then convert the hash into an integer. In Ruby: 'ff'.to_i(16) => 255; '0100'.to_i(16) => 256

XOR this integer with the following hex-encoded integer:

8d1ada6e99fd7afa3c3f1f44163aa9ff3fb67350b1f63d582b0109c63e4e78d31ee7e3b6fe

Convert the XOR result into a Base58-encoded string. You can use the base58 gem in Ruby.

— Note: We were using the Base-58 alphabet from the Ruby gem to generate the XOR integer. You need to use the same alphabet to encode the private key, but WIF uses a different alphabet. We’re glad the winner was able to spot our mistake!

Congrats! You now have the private key for our Bitcoin address. This means that you could have transferred the balance to your own address, minus a transaction fee.