If the creator did not legally relinquish ownership (e.g., via a smart contract or binding terms), brute-forcing the key might still be considered theft.

If the owner did not clearly relinquish ownership (e.g., by publishing a signed transaction or legal agreement), taking funds may be unlawful.

Intent: If the puzzle is structured as a brute-force attack rather than a solvable riddle, it could be argued that the creator is inducing illegal activity.