Hey, guys.

Here's a challenge to win 10,000,000 sats, worth about $6,400 when posted here.

This is a reverse deduction puzzle, NOT a brute force one, nevertheless, any attempt at a brute force solution is welcome, and any analysis with the help of AI tools is also welcome.

The puzzle is as follows

---

1. Here's the BIP39 seed phrase named S1, and the 12 seed words are:

2. Here's a set of two cards called CipherCard used for encryption, the black card is a data card with a lot of substitution characters laser-engraved, and the silver card is covered with cut-out holes and index characters laser-engraved.


3. Now using the CipherCard as the picture shows to perform substitution encryption on the seed phrase S1, to get ciphertext C1 as follows:

---

You can claim the prize if you can derive the substitution RULE for converting from plaintext to ciphertext based on plaintext S1, ciphertext C1, and the CipherCard mentioned above.

Bitcoin transaction fees will be paid out of the prize, receiving the prize is completely tax-free in some countries, while in others you will be taxed when you exchange bitcoin for local fiat currency.

Here's How

---

Let's assume you've tried to recover this wallet by entering S1 plaintext into Electrum or whatever software/hardware wallet you prefer, if you're not sure about the derivation path, here's a hint:

Now you can see that the entire balance in this wallet was spent to a 2-of-3 multisig wallet address:
And this is our jackpot.
 
You already control the first Master Private Key of this multisig wallet because you know S1, you can easily verify that the first Master Public Key is:

If you're not sure about the derivation path of this multisig wallet, here's another hint:

To create an observation wallet, the other two Master Public Keys you need are as follows:

But to spend the balance of this 2-of-3 multisig wallet, you have to control at least one more private key, and the only information you can get about this second private key is the following ciphertext C2:

As mentioned, you have derived the substitution RULE for converting from plaintext to ciphertext by using plaintext S1, ciphertext C1, and CipherCard, it will not be difficult to invert plaintext S2 from ciphertext C2 and CipherCard.

When you get S1 and S2, you'd better sweep up all your prize at the first opportunity in case some other smart guy gets there first. After that, please take some time to detail your analysis process so I can improve the rules, thanks in advance.

The puzzle won't be too easy, requiring basic math knowledge about bitcoin and blockchain, a bit of patience, and a bit of luck. Yet it won't be too hard either, as you can see from the short ciphertext (compared to the plaintext), that I haven't used too many tricks to interfere with your analysis.

If you do put in a little effort but can't solve the puzzle, you can forward it to the guy you think is the smartest among the people you know and then share the prize with them.

Of course sponsoring this challenge is also appreciated, and I'm really thinking about how to give the challengers and sponsors a little surprise, any offers?

Additional useful information

---

Considering that not having a physical card in your hand will inconvenience you in recognizing and reading the substitution table, I list all the possible combinations regarding the stacked placement of the two cards below.




Have fun solving the puzzle, and, well, good luck!