Quindecillions: Why Nobody Can Stumble on Your Bitcoin

Where you're going: After we published two vanity addresses in October 2026, the same two questions came back again and again: did the address already have money in it, and how many wallets did the search find on the way? Both assume the address space is like a phone book, big but populated. This chapter replaces that picture with a wall of drawers. It counts the drawers, counts the ones with coins in them, works out what a search of a trillion keys passes on the way to a match, and then looks at where the real "someone found a wallet" stories come from. It ends with the reason a space this large means nobody has to ask permission, or register anything, before making a key.

Credit: This chapter recreates a lesson from James D'Angelo's "Bitcoin 101" Blackboard Series for the World Bitcoin Network: "Quindecillions & The Amazing Math Of Bitcoin's Private Keys" (17 October 2014). The drawers and the pirate are his picture. The words, the drawings, the animations and the numbers here are ours, rebuilt from October 2026 data. It is the first in a set of credited recreations of the Blackboard Series.

The question we keep getting

In October 2026 we ran two vanity address searches on a laptop, twelve CPU threads and no GPU. The first asked for an address beginning 1LearnBTC, in any letter case, and found one after 46 minutes and about 203 billion keys. The second asked for bc1qlearn8tc exactly and found one after 6 hours 1 minute and about 1.24 trillion keys. Between them the two runs generated 1.44 trillion private keys, turned each into an address, and threw every one away that did not start with the right eight characters. The glossary entry has the table and the receipts.

The questions that followed were the same ones James D'Angelo was answering on a blackboard in 2014. Did 1LeArNBtc... already have money in it when we found it? And out of 1.44 trillion addresses, how many belonged to somebody?

The honest answer to the second question is that the software never looked. A vanity searcher compares each address against a pattern, not against the ledger. So the real question is about chance: out of 1.44 trillion addresses, how many would you expect to hold coins? The rest of this chapter is the arithmetic behind the answer, which is zero, to about 28 decimal places.

A key is a number, an address is a shorter hash

A Bitcoin private key is a number between 1 and a 78-digit limit set by the curve Bitcoin uses: 115,792,089,237,316,195,423,570,985,008,687,907,852,837,564,279,074,904,382,605,163,141,518,161,494,336 valid keys, about 1.16 x 10^77. Our Key Space chapter is the scale walk for that number, and nothing here repeats it.

An address is smaller. For the addresses most people use, the ones that start with 1, 3 or bc1q (the 42-character kind), the wallet takes the public key, or for a 3... address a script, runs it through two hash functions, SHA-256 and then RIPEMD-160, and keeps the 20-byte result. Bitcoin Core calls that function Hash160. Twenty bytes is 160 bits, so there are 2^160 possible addresses of this kind: 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976, or about 1.46 x 10^48. The three spellings are one space. A P2PKH address, a P2SH address and a P2WPKH address each wrap a 160-bit number in a different encoding and a checksum; the checksum lengthens the address and adds no new addresses.

Two consequences follow. First, since there are 2^256 keys and 2^160 addresses, about 2^96 keys lead to each address: 7.9 x 10^28 of them, on average. No such pair has ever been published, and finding one is a 2^80 problem that Key Space already covers. Second, the word in the title counts addresses. A quindecillion is 10^48 in the counting used in American and modern British English, and 2^160 is 1.46 x 10^48, so the drawers number about one and a half quindecillion. The title names the address space; the key space is 29 orders of magnitude larger. We are counting addresses, because an address is the drawer a stranger's coins sit in.

One aside before the drawers. Two newer output types do not fit the 160-bit story at all. A P2WSH address commits to a 256-bit hash of a script, and a Taproot address, the bc1p kind, commits to a 256-bit public key with no hash in front of it. A key search that works through a 160-bit hash cannot reach either, and the chapter counts them separately below. How Taproot Works has the mechanism.

A wall of drawers

Here is D'Angelo's picture, in our words. Every address is a drawer. The drawers are not in a building, because no building holds 10^48 of anything; they are in a wall, and the wall is itself one drawer in a bigger wall, and so on, twenty-four times. The animation zooms out by a factor of a hundred at each step and names what each scale means for you.

Two of those captions need their working shown.

The first is the birthday bound. If people pull drawers at random from a wall of 2^160, how many pulls before two of them are likely to land on the same drawer? The answer for any wall of N drawers is about 1.18 times the square root of N, and for N = 2^160 that is 1.42 x 10^24 draws. Every address anyone has ever made is a draw from this wall. Nobody publishes a count of how many addresses have existed; take a round two billion as a guess on the high side, and the chance that any two of those two billion coincide works out to about 1 in 7 x 10^29. That is why no such collision has ever been published, and why no wallet bothers to check.

The second is the per-key figure. ChainQuery walks the whole set of unspent coins every Sunday and groups them by address. At its 25 October 2026 snapshot, block 973,026, 57,213,806 addresses held at least one unspent output. Divide the wall by that count and you get the average number of drawers a random key would have to open before one of them held anything: 2^160 / 57,213,806, which is 2.55 x 10^40. The odds for a single key are the reciprocal, 1 in 2.55 x 10^40, and they are an upper bound, because 5,098,744 of those funded addresses are Taproot and up to 2,837,579 more are P2WSH, drawers a 160-bit search cannot open at all. The set it can reach is about 49 to 52 million, and the exponent does not move. One more number from the same snapshot: 31.7 percent of funded addresses hold less than 0.0001 BTC, so a search that did land on one would, one time in three, find less than ten dollars in it, and more often than not less than a hundred.

The pirate

Now give the drawers to a pirate who opens them one at a time, as fast as our laptop generated keys: up to 74 million a second.

The pirate's single laptop needs about 1.09 x 10^25 years to expect one funded hit. The universe is 13.82 billion years old, so that is roughly 790 trillion universe ages. Three larger searchers:

• Give every one of the 8.2 billion people on Earth the same laptop and run them all at once: about 1.3 x 10^15 years, which is 96,500 universe ages.
• Take the whole Bitcoin mining network, about 1.09 x 10^21 hashes a second on 28 October 2026, and pretend each hash were a key check: about 7.4 x 10^11 years, 54 universe ages. A mining hash is SHA-256 twice over an 80-byte block header; a key check is a multiplication on the curve followed by two hashes, and mining hardware cannot do it. The row is an upper bound on speed by a wide margin.
• Key Space imagines ten billion computers checking a trillion keys a second each for a billion years, about 2^128 keys in all, and gives that fleet a few chances in ten billion of hitting one particular address. Run the same fleet against every funded address at once and its chance after a billion years is about 1.2 percent.

Which brings us back to our two searches. The chance that any one of the 1.44 trillion addresses we generated held coins was at most 5.6 x 10^-29, or about one in 1.8 x 10^28. An adult human body contains about 7 x 10^27 atoms. So the odds were the same as naming one atom in advance and then drawing it, blind, from all the atoms in two and a half people. That is why the answer to "how many wallets did you find?" is zero.

Where the "found a wallet" stories come from

They are real, and every one we could find is one of two failures. Neither is a search of the address space.

The human picked the key. A brain wallet, in its original form, is a passphrase run once through SHA-256 and used as the private key. The Bitcoin Wiki files the scheme under "Obsolete brainwallet style" with the line "Humans are not a reliable source of entropy". The attacker does not search 2^256 keys; he searches the phrases people pick: dictionaries, song lyrics, quotations, leaked password lists, with the usual capitalisation and punctuation rules applied, and he checks every candidate against every funded address at once.

Ryan Castellucci showed how at DEF CON 23 on 7 August 2015, where he released a cracker called Brainflayer. It tested each candidate phrase against a lookup filter built from every address that had ever received coins, so one guess was checked against the entire funded set in one step, and his slides total the peak balances of everything he had cracked at "733 BTC", none of it kept. In the paper that followed, Vasek, Bonneau, Castellucci, Keith and Moore tested around 300 billion candidate passwords against the whole chain through August 2015 and found 884 brain wallets. They had received 1,806 BTC between them, and half were drained within 21 minutes of being funded. Our two vanity runs tried 1.44 trillion keys, five times as many, and the arithmetic says they found nothing. The 300 billion were drawn from the set of phrases people pick; our 1.44 trillion were drawn from 2^256.

New brain-wallet deposits are rare and have not stopped. The Milk Sad research group's January 2026 update counts 20,397 one-round-SHA-256 brain wallet addresses found in total and records a 5.26 BTC deposit swept in February 2025, "very plausibly" within seconds. Castellucci's 2015 slide described the market he was walking into: "Every 5 character password I try gets swiped in seconds." The February 2025 sweep shows the same market ten years later.

The software's randomness was broken. The other family of stories is wallets that asked for 128 or 256 bits of randomness and got far fewer. The attacker then enumerates the small space the bug created, exactly as Brainflayer enumerates phrases.

Case	When	What went wrong	What was left to search	What was taken
Android wallets (bitcoin.org alert)	August 2013	The platform's random number generator was not properly seeded; the same signing nonce was reused across transactions	No search at all: two signatures with the same nonce give up the private key in one equation	A forum post of 10 August 2013 counted 55.82 BTC on one collecting address "so far"; no total exists at a primary source
Trust Wallet browser extension (CVE-2023-31290)	Bug November 2022, exploits December 2022 and March 2023	A general-purpose random number generator (Mersenne Twister) seeded with 32 bits	About four billion possible seed phrases	About 170,000 dollars in two exploits, per the vendor's post-mortem
Libbitcoin Explorer, "Milk Sad" (CVE-2023-39910)	Code from 2017, sweeps May to July 2023	Mersenne Twister seeded with 32 bits of system time	2^32 seeds, every one checkable by a gaming PC in under a day	About 29.65 BTC in one sweep on 12 July 2023, over 2,600 affected wallets
Randstorm (browser wallets, 2011 to 2015)	Disclosed November 2023	Weak browser randomness in BitcoinJS-era wallet code	Unciphered's own exposure model: about 1.4 million BTC in potentially weak wallets	An estimate only; no confirmed theft is attributed to it
COLDCARD Mk2 and Mk3	Firmware from March 2021, thefts 29 to 30 July 2026	A build flag routed seed generation to a software generator instead of the hardware one	About 40 bits of randomness (entropy) instead of 128	"Estimated losses exceed 1,000 BTC" (Optech); the keys were regenerated offline, the devices were never touched

In every row the attacker searched a small space that a human or a bug had created. On Ethereum, a 2019 study found 732 private keys in use that sat in 32-bit corners of that chain's key space, put there by faulty code. The websites that claim to list every Bitcoin private key are the same arithmetic again: a page is a short list of keys computed from its page number, with a balance lookup attached, so opening one is a handful of random draws from 2^256. "I checked a page of the directory and it was empty" is the only result the odds allow, and a funded key on such a page is a weak key, chosen by a human or made by a broken generator.

What this means for you is in Seed Backup Strategies and the seed phrase entry: twelve words carry 128 bits of randomness and 24 carry 256, when the wallet makes them. The entropy bits entry has the counts.

What brute force has actually reached

Brain wallets and broken generators are failures of the key. The public record of what plain brute force reaches against properly random keys is thinner. Two instruments exist.

On 15 January 2015 someone sent 32.896 BTC to 256 addresses in a single transaction, 0.001 BTC times k to the k-th address, where the k-th private key had been chosen from a k-bit range. Puzzle 1 has a one-bit key, puzzle 66 a key between 2^65 and 2^66, and so on. The creator's one known post, on 27 April 2017, called it "simply a crude measuring instrument, of the cracking strength of the community", then raised every unsolved prize tenfold that July and tenfold again in April 2023, so since April 2023 an unsolved puzzle k holds 0.1 x k BTC. The ranges are tiny by the standards of this chapter, and that is the point: they make a search that would never end in 2^160 finish in months, and the solve dates are the measurement.

Two different problems live on that board. While a puzzle's public key is unknown, the only attack is the one from the previous section: pick a key in the range, derive the address, compare. On 1 June 2019 the creator spent a tiny amount from puzzles 65, 70, 75 and every fifth puzzle up to 160, and a spend from a legacy address (one starting with 1) puts the public key on chain. From that block those twenty puzzles became a different problem, working back from a known public key to its private key inside a known range, which the Pollard's kangaroo method does in about the square root of the range's width, with no hashing at all. That is why puzzle 105 fell in 2019 while puzzle 64 waited until 2022, and why puzzle 135 fell on 28 July 2026 while puzzle 71 was still open on 28 October 2026. A "puzzle 135 solved" headline reports a kangaroo result over a known public key. Use It Once and the public key exposure entry are about the same fact from the user's side.

The brute-force record is puzzle 69. Its key sat in a range of 2^68 keys, about 2.95 x 10^20, and the 6.9 BTC left the address on 30 April 2025 in block 894,620. Puzzle 66 went in September 2024, 67 in February 2025 and 68 in April 2025. By the account posted to the puzzle's forum thread on 13 September 2024, the puzzle 66 solver broadcast a spend, which put the public key into every node's mempool, and 45 seconds later a bot with a kangaroo solver had recovered the 66-bit key from it and replaced the transaction with a spend paying 78 times the fee rate to a different address. The chain shows only the winner: the mined transaction went to the bot's address. As of 28 October 2026, 83 of the 160 puzzles are solved, puzzle 71 is the lowest open at 7.1 BTC, and 903 BTC sits unclaimed on the rest.

The other instrument is the Large Bitcoin Collider, a pool that opened in August 2016 to enumerate private keys from 1 upward, two addresses per key, against a filter of every funded address. Its archived statistics pages show a high of 2,771 million keys a second in December 2017, and it was still running on 28 October 2026, when its statistics page read 55.87 of 160 bits covered: about 6.6 x 10^16 keys in ten years. Its trophies page lists what all of that found: the keys to puzzles 43 through 54, and three dust addresses holding about 0.008 BTC between them whose private keys were numbers below 2^51, apparently deposited as tests. The last entry is dated 15 November 2017.

Search	Years	Keys covered	Share of the 2^160 address space	What it found
The puzzle, brute-force part (puzzles 1 to 69)	2015 to 2025	At most 2^69, about 5.9 x 10^20 (the cleared ranges added together; the largest single range, puzzle 69, is 2^68)	1 part in 2^91	The 69 keys the creator placed there
The puzzle, known-public-key part (65, 70, ..., 135)	2019 to 2026	Not a key search: about 2^68 curve operations for puzzle 135	n/a	15 keys the creator placed there and whose public keys he exposed
Large Bitcoin Collider	2016 to 2026	2^55.9, about 6.6 x 10^16	1 part in 2^104	Puzzle keys 43 to 54; three dust addresses with keys below 2^51
Our two vanity searches	2026	2^40.4, about 1.44 x 10^12	1 part in 2^120	Two addresses matching eight chosen characters
All of the above together	2015 to 2026	At most about 2^69, on the order of 10^21	About 1 part in 2^91	Only keys that were deliberately placed in small ranges

Pooled over eleven years, the largest public searches for Bitcoin keys have covered at most about 2^69 keys. That is one part in 2^91 of the address space, and one part in 2^187 of the key space. Key Space's imaginary fleet reaches 2^128; the real record is fifty-nine doublings short of the imaginary one and ninety-one short of the address space.

No registry

Phone numbers, domain names, bank account numbers and licence plates all need a registry, because their spaces are small enough that two people would otherwise pick the same one. Someone has to hand them out and keep the list. Bitcoin's space is large enough that nobody has to ask.

Suppose every one of the 8.2 billion people on Earth generated one key a second, with no coordination and no list anywhere, for a hundred years. That is 2.59 x 10^19 keys. The chance that any two of those private keys are the same is 2.9 x 10^-39. The chance that any two of the resulting addresses coincide, the 160-bit figure, is about 1 in 4.4 billion. The chance that any one of them opens an address that held coins at the 25 October 2026 count is about 1 in 10^21; the century-long experiment would have to be repeated 10^21 times to expect a single such hit.

That is the whole reason a key made on a laptop with the network cable unplugged is as valid as a key made anywhere else. There is no issuer and no permission step, because there is nothing a registry would protect against. Our Decentralization chapter is about what that buys.

Pro tip: Let the wallet make the randomness. Never derive a key from a phrase you chose, a song lyric or a sentence from a book: the common ones have all been tried against every funded address, and the drainers run bots. If a tool offers a box for typed entropy, leave it empty.

What this buys us

• You know what a search passes on the way to a match. Our two runs generated 1.44 trillion addresses, and the chance that any of them held coins was at most 5.6 x 10^-29.
• You know where the real stories come from. In every documented case the key was chosen by a human or weakened by a bug, and the attacker enumerated a small space.
• You know what brute force has actually reached. At most about 2^69 keys in eleven years of public effort, one part in 2^91 of the address space, and only keys that were placed in small ranges.
• You know why there is no registry. It takes 1.42 x 10^24 random addresses before any two are likely to coincide, and everyone on Earth generating one key a second for a century has about one chance in 4.4 billion of producing two matching addresses. A key made offline is as valid as any other, and there is no list to hack or subpoena.
• You know the honest boundary. None of this protects a key a human chose or a bug weakened, and none of it is about the one attack that skips guessing altogether; that lives in Quantum and Bitcoin.

Let the wallet roll the dice.