Can You Break Bitcoin's Cryptography?

No one has ever broken bitcoin’s cryptography, and with current technology no one can. The two algorithms guarding every coin, the SHA-256 hash function and elliptic curve digital signatures, have withstood seventeen years of motivated attack. When bitcoin gets stolen, thieves go around the mathematics instead: they raid exchanges, phish seed phrases and infect computers.

That makes this a strange entry in a list of unsolved problems. The challenge is not “break bitcoin” the way the Collatz conjecture is “prove this statement”. The open question sits underneath: nobody has proved that the functions protecting bitcoin are actually hard to reverse. Everyone believes it. No one can show it.

What actually protects a bitcoin

Bitcoin, described by Satoshi Nakamoto in a 2008 white paper, leans on two pieces of standard cryptography.

The first is SHA-256, a hash function standardised by the US National Institute of Standards and Technology (NIST). It takes any input, a word or a whole hard drive, and produces a 256-bit fingerprint. The same input always gives the same fingerprint, and changing a single letter produces a completely different one. Bitcoin uses it everywhere: miners race to find blocks whose hash falls below a target, and addresses are built from hashed public keys.

The second is ECDSA, the elliptic curve digital signature algorithm, on a curve called secp256k1. Your private key is a 256-bit number. From it, a one-way calculation produces your public key. Signing a transaction proves you hold the private key without revealing it. Going backwards, from public key to private key, is called the elliptic curve discrete logarithm problem, and nobody knows an efficient classical way to do it.

Note the date in the fact strip above. Bitcoin posed this version of the question in 2008, but the underlying puzzle is older. Cryptographers have asked whether one-way functions genuinely exist since the field went public in the 1970s, and Claude Shannon was already reasoning about what makes a cipher secure in the 1940s.

Why you cannot decrypt SHA-256

People search for “SHA-256 decrypt” thousands of times a month, and the phrase is a category error. Decryption undoes encryption, and encryption is reversible by design: a cipher scrambles data so that someone holding the key can unscramble it. A hash function is different. It is deliberately built with no key and no way back.

The reason is information loss. SHA-256 maps inputs of any length to exactly 256 bits. Hash every possible 1-gigabyte file and you get more inputs than outputs by an absurd margin, so infinitely many inputs share every fingerprint. Even a perfect adversary with unlimited computing power could not tell you which input produced a given hash, only find some input that matches. The original is simply not in there, the way a person is not inside their own fingerprint.

So the websites offering to “decrypt” a hash are doing something much less clever: they keep giant lookup tables of already-hashed common passwords. If your input was hunter2, they will find it. If it was a random 256-bit key, they never will.

You can feel this yourself in the demo above. Type a sentence, watch the hash, then change one letter. The output scrambles entirely, and there is no button anywhere that turns it back.

The arithmetic of 2^256

Brute force is the attack that always works in principle: try every key until one fits. Against 256 bits it collapses into farce, and the numbers deserve to be spelled out honestly.

2^256 is about 1.2 x 10^77. That is not “more than the atoms in the observable universe”, a claim you will see repeated; astronomers put the atom count at roughly 10^80. It is merely within a few orders of magnitude of it, which for a number you can write on a napkin is remarkable enough.

Counting speed is not even the real barrier. Physics sets a floor, the Landauer limit, on the energy any computer needs to flip a bit: about 3 x 10^-21 joules at room temperature. Capture the Sun’s entire output for a year, roughly 1.2 x 10^34 joules, feed it to a computer running at that thermodynamic minimum, and you could count through about 2^181 values. Not 2^256. Closing the gap means finding another factor of 2^75, roughly the yearly output of every star in the observable universe, just to count that high, never mind compute a hash at each step.

The bitcoin network itself is the best brute-force machine ever assembled. In 2026 it computes around one zettahash per second, a rough figure that drifts with mining economics, which is 10^21 SHA-256 hashes every second. Pointed at a single 256-bit search, the entire network would need about 10^48 years. The universe is 1.4 x 10^10 years old. The demo above runs the same attack against toy keys of 16 to 32 bits and then extrapolates your own machine’s measured speed up to 256 bits, which is a good way to feel where intuition gives out.

The unsolved problem underneath

Here is the part that earns this page its place among open problems. All of that security rests on functions being one-way: easy to compute forwards, infeasible to invert. And no one has ever proved that one-way functions exist.

Proving it would settle enormous questions. If one-way functions exist, then P does not equal NP, since inverting a function is a search problem whose answer is easy to check. The full story is on our P versus NP page, but the short version is that mathematics cannot yet rule out a fast algorithm for every problem whose solutions are quickly checkable, and that includes finding hash preimages and discrete logarithms. The same gap between checking an answer and finding one drives the travelling salesman problem.

Shannon’s wartime work showed that provably unbreakable encryption is possible but demands keys as long as the message itself. Everything practical since then, bitcoin included, trades that proof away for convenience and an assumption of hardness. Decades of failed attacks are strong evidence for the assumption. They are not a proof, and a proof is exactly what is missing.

The honest quantum answer

Quantum computing changes the two algorithms unevenly, and it is worth keeping them separate.

For elliptic curve signatures the threat is real in principle. Shor’s algorithm, run on a large enough quantum computer, solves discrete logarithms efficiently. A 2017 study by Roetteler and colleagues at Microsoft Research estimated that breaking a 256-bit elliptic curve key needs about 2,330 logical qubits and roughly 10^11 quantum gate operations. Logical qubits are the error-corrected kind, each built from many physical qubits. Machines in 2026 are orders of magnitude short of running a computation like that.

For SHA-256 the news is duller. Grover’s algorithm, the best known quantum attack on hashing, gives only a square-root speedup, cutting effective security from 256 bits to 128. A 128-bit search is still far beyond anything physical.

And the ecosystem is not standing still. NIST finalised its first post-quantum standards in August 2024, ML-KEM for key exchange and ML-DSA for signatures, built on lattice problems that resist Shor’s algorithm. Bitcoin’s rules can change through soft forks, so quantum-safe address types can be added well before a relevant machine exists. The likelier casualties of early quantum computers are old coins sitting on addresses whose public keys are already exposed, a cleanup problem rather than a collapse.

What “bitcoin hacks” actually are

Headlines about stolen bitcoin never describe broken cryptography. Mt. Gox, the exchange that collapsed in 2014, lost around 850,000 bitcoins to years of quiet theft enabled by sloppy custody. The Bybit theft of February 2025, at roughly 1.5 billion dollars the largest crypto heist so far, worked by tricking staff into approving a malicious transaction. Add phished seed phrases, malware that swaps wallet addresses on the clipboard, and plain scams, and you have essentially the whole genre.

This is Willie Sutton logic. Thieves go where the money is easiest, and the easiest place is never the mathematics. Bitcoin was worth around 1.3 trillion dollars in total at mid-2026 prices, an open bounty on SHA-256 and secp256k1 that has stood unclaimed since the internet age produced the network in 2009. Every thief so far has declined it in favour of attacking people.

That is the state of the challenge. You cannot break bitcoin’s cryptography today, and the demo above shows why your computer never will by force. Whether it is unbreakable in principle waits on some of the deepest open questions in computer science.