The timeline of solved challenges is the only honest measure of the actual key search capability — because each line is a published result, verifiable on the blockchain, and not just a forum claim.
The first steps fell almost effortlessly. Keys of one, two, five, ten bits can be found by anyone with a calculator and patience, and were swept away in the first few months. Up until around the fiftieth step, the story is the same: a common computer, a few hours, and the address is emptied.
From the fifty-something bits onwards, things change in nature. The steps begin to be taken down by people with farms of graphics cards, and the interval between one step and the next is no longer measured in weeks but in years. Each bit doubles the work, and the staircase becomes increasingly steep at exactly the predicted rate.
Two families of results coexist in this list, and confusing them is the most common mistake for those reading the table for the first time.
In the first family are the lower-numbered steps, attacked by pure brute force. Only the address is known, there is no shortcut, and the solution is brute force on graphics cards, exactly as Lesson 2 of the previous module described. The time is proportional to the entire interval.
In the second are steps with much higher numbers — well above what any brute force could reach — that fell nonetheless because their public key was exposed. Here the method is Pollard's kangaroo, and the cost is the square root of the interval. This is why the table has seemingly absurd jumps, with very high steps solved while much lower steps remain standing: it's not luck or genius, it's the difference between attacking the interval and attacking its root.
It's also worth mentioning the ugly part, because it's part of the story and teaches more than the victories. In more than one case, the person who found the key didn't get the prize. The transaction that moves the coins needs to be broadcast to the network and becomes visible in the mempool before being confirmed — and there are programs watching the mempool exactly for this. Seeing the key revealed in the signature, an observer creates a competing transaction with a much higher fee, and the network confirms theirs. This is called a transit theft, and it has happened to those who scanned for months.
The defense is known: arrange with a miner beforehand so that the transaction enters a block without going through the public mempool. It's laborious, requires prior contact, and those who discover this after losing learn it the hard way.
What the entire timeline teaches, in the end, fits into three sentences.
First: progress is exponentially slow. Decades of hardware improvement have bought a few dozen bits, and will buy a few dozen more at the same pace — which leaves 256 bits beyond any imaginable horizon.
Second: what decides the real difficulty is not the size of the key, but what is exposed. A small interval with a published public key falls; the same interval hidden behind a hash resists much more.
Third: none of these results touched cryptography. No curve was broken, no hash was inverted. What fell was what always falls — small search spaces, deliberately chosen by those who set up the challenge.
And when it's not deliberate? There is an entire category of weak keys that no one created as a joke, and whose money was lost forever due to a choice that seemed smart at the time. In the next lesson, brain wallets.