On January 15, 2015, a single transaction funded 256 bitcoin addresses at once. This is not a legend, not a forum rumor, and it doesn't rely on believing anyone: the transaction is on the blockchain, with date and time, and anyone with a node can check each of its outputs.
What makes these 256 addresses special is not the amount they received, but how their keys were chosen. The key for the first address is a one-bit number. The second is between two and three. The third, between four and seven. The nth one is somewhere between 2 raised to the power of n minus one and 2 raised to the power of n. Each step is exactly twice the size of the previous one.
Notice what this design produces. The first addresses are trivial: the key for the first is the number one, and anyone can find it off the top of their head. Around the twentieth, a common computer solves it in seconds. By the fortieth, a graphics card takes minutes. By the sixtieth, weeks. And from there, the staircase is out of reach for anyone with household equipment, exactly as the previous module calculated.
This is why the set became what it did: a ruler. It measures, with one-bit precision, how far key searching has really reached at each time — not in theory, but with real money waiting for whoever can succeed.
The amount deposited in each address grew along with the challenge number, giving the set a second elegant property: the harder the step, the greater the reward for climbing it. In 2017, the author reappeared in a public forum, increased the amounts for unresolved addresses, and described the set as what it always seemed to be — a test of the network's security, not a gift.
There is a technical detail in this 2017 story that decides almost everything the next lesson will cover. To interact with the addresses, it was necessary to spend from them — and spending means publishing the public key, as the intermediate trail explained. From that moment, some of the unresolved challenges had their public keys exposed on the blockchain, while others did not.
The difference is the same as the one Lesson 1 of the previous module distinguished. Where the public key is exposed, the problem is a discrete logarithm in a known range, and Pollard's kangaroos attack the square root of the range. Where only the address exists, the entire range must be scanned, candidate by candidate. Two neighboring challenges on the staircase, with a one-bit difference between them, can be practically years apart just because of this.
It's also worth saying what this set does not prove. It shows no weakness in Bitcoin. The keys were deliberately drawn in tiny intervals by their creator; no wallet in the world does this, and a correctly generated key has a full 256 bits of space ahead of it. What the challenges measure is the world's search capability — and the fact that the staircase remains standing above a certain height, year after year, is the most honest demonstration of security one could ask for.
Proportionally speaking, it's like a series of safes with increasing thickness left in a public square with an explicit invitation to break into them. That the thin ones have fallen says nothing against the thick ones. It merely indicates where the saw is.
Which steps have already fallen, when, by what method, and by whom — including cases where the key was found and stolen on the way between discovery and withdrawal. In the next lesson, the real chronology.