Brute force is the dumbest strategy there is, and it's the only option when the target is an address. It's also surprisingly fast, for a reason that almost no one notices at first: no one calculates each key from scratch.
Testing a candidate requires four steps. Multiply the generator by the candidate number, which produces the public key. Pass the public key through SHA-256. Pass the result through RIPEMD-160. Compare the twenty bytes with the sought address. The first step is dozens of times more expensive than the other three combined — and it's precisely this step that search programs avoid.
The trick is to search candidates in sequence. If you already have the point corresponding to k, the point corresponding to k plus one is that point added to G: an addition, not a full multiplication. And since every point addition requires a division in the finite field, which is the costly operation there, a second trick is used, known as batch inversion: a single inversion is calculated for hundreds of points at once, and the cost per candidate plummets.
With these two optimizations, a modern graphics card tests a few billion candidates per second. It's an impressive number, and what it means deserves to be weighed carefully.
A seventy-bit range has 2^69 candidates, which is approximately 590 quintillion. Dividing by three billion per second gives about two hundred billion seconds — around six thousand two hundred years on a single card. A thousand cards in parallel reduce this to just over six years. Ten thousand cards, to seven months.
Now the electricity bill, which is what truly decides. One of these cards consumes about four hundred watts. Multiplying by the total duration of the work, the complete sweep of seventy bits consumes around twenty-two gigawatt-hours — the consumption of a medium-sized city for a few days, regardless of how many cards you use to get there. Dividing the work among more machines shortens the timeline but doesn't change the energy.
And then comes what ruins everything: each additional bit doubles the entire cost. Seventy-one bits cost twice as much in time and twice as much in energy. Seventy-five cost thirty-two times more. Eighty bits cost a thousand times more than seventy — and a thousand times twenty-two gigawatt-hours is an amount of energy that no private operation buys to search for a key.
It's worth being precise about a comparison that appears often. The entire Bitcoin network calculates around a sextillion hashes per second, a number hundreds of times larger than any graphics card farm — and yet it's not suitable for this. An ASIC miner knows how to do only one thing, SHA-256 on an eighty-byte header, and doesn't know how to multiply points on a curve. The hardware that solves one challenge is different, and much slower.
That's why the brute force frontier on addresses is, today, somewhere between seventy and eighty bits, and it doesn't advance because someone had a better idea: it advances when hardware becomes cheaper, and slowly. No software optimization changes the exponential nature of the wall.
It's worth noting two practical warnings. The first is that the number of keys per second that programs advertise varies greatly depending on what is being searched for — searching for a specific address, searching for any from a list of thousands, and searching for a prefix are tasks with very different costs. The second is that much of the advertised gains come from comparing against a list loaded in memory, not from calculating faster.
This entire lesson assumed the worst case: only the address is known. When the public key is exposed, the problem shifts from sweeping the range to being a discrete logarithm — and then there is a shortcut that reduces 2^69 attempts to something close to 2^35. In the next lesson, the first of these shortcuts: trading memory for time.