Quote from: Wanderingaran on Today at 12:49:54 AM

Quote from: Benjade on Today at 12:00:58 AM

Quote from: Wanderingaran on June 26, 2025, 10:11:21 PM

Quote from: Benjade on June 26, 2025, 08:39:30 PM

“Unauthorized access” only occurs when you defeat a safeguard without the owner’s permission.
The puzzle creator has already said “first to crack the key keeps the coins,” which is explicit consent, exactly like a bug-bounty program inviting you to hack their test server. Contract law treats that as a unilateral offer: perform the task, keep the reward. Once consent is public, brute-forcing the key is neither theft nor computer misuse, because the owner has waived exclusivity and the only “system” you touch is the open blockchain.

Here:
Computer Fraud and Abuse Act — 18 U.S.C. § 1030(a): every CFAA offense hinges on accessing a computer “without authorization” or “exceeding authorized access.” If the owner invites you to try, that element is missing. https://www.law.cornell.edu/uscode/text/18/1030

And there:
DOJ charging policy for the CFAA (19 May 2022): prosecutors are told not to bring charges for “good-faith security research” when the owner has authorized the activity. https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act

The puzzle creator’s public statement might imply consent, but unless it’s a legally binding contract (with clear terms, jurisdiction, and revocation mechanisms), authorities could still argue the method of access (e.g., brute-forcing) violates computer crime statutes. Courts often interpret “authorization” narrowly, e.g., Van Buren v. United States (2021) highlighted ambiguities in what exceeds "authorized access."

While the DOJ’s 2022 policy discourages charges for "good-faith security research," brute-forcing a private key lacks the same recognized public benefit as vulnerability disclosure. The policy also explicitly excludes "malicious" acts, and prosecutors might view unsanctioned access to funds (even via puzzles) as financially motivated rather than research.

Even if CFAA liability is avoided, criminal theft laws (e.g., state statutes) could apply. Most jurisdictions require explicit, lawful transfer of property. Cracking a key isn’t a traditional legal mechanism. The creator’s intent might not override statutory definitions of theft or fraud.

Unlike a test server in a bug bounty, the blockchain is a public ledger; the "system" accessed is the network itself. If the wallet’s security relies on cryptographic safeguards, bypassing them could be argued as circumventing a "technological barrier" under laws like the DMCA §1201 (though this is untested for puzzles).

Think about it for 2 seconds, these are addresses whose private keys are very limited in their range and created specifically to make them easier to find. What don't you understand about the law? It's written in black and white.

I have thought about it. And as someone who works in cybercrime investigations, I can tell you the law isn’t as binary as "the creator said it’s okay, so it’s legal." The law is written in black and white, but the words say "authorization," not "vibes." Unless the creator formalized this as a binding offer (a smart contract with explicit terms), you’re relying on not getting caught, not legal immunity.

Brute-forcing a key isn’t a recognized legal mechanism.

The creator’s intent might be clear to you, but courts need evidence of a valid contract or gift. If the private key is hidden within a puzzle or image (steganography, riddles, or cryptographic clues) and publicly posted (like GSMG.IO puzzle) by the owner, that’s fundamentally different from brute-forcing under the law.
Puzzle-solving = The owner deliberately encodes the key and invites solvers to extract it. This is closer to a unilateral contract ("Solve this, claim the prize").

If a company posts a puzzle on its website, that’s strong evidence of consent. Courts recognize "invited access". Brute-forcing lacks this clarity. Even weak keys don’t prove the owner authorized all methods of access.

Again you’re mixing up a legal debate with the plain technical meaning of “brute-force.” In crypto, a brute-force attack is simply trying every possible key until one works, full stop. People have been invited to do exactly that for decades. RSA-129’s 129-digit ciphertext was cracked in 1994 by hundreds of volunteers who exhaustively searched the key space; the judges didn’t ask for a “binding offer,” they sent a congratulatory letter when the key fell after eight months of grinding CPUs. https://seclists.org/interesting-people/1994/May/42

A few years later, distributed.net tore through the RC5-56 challenge in 250 days, publicly billing the effort as “brute-forcing the entire keyspace” and collecting RSA’s prize with no courtroom drama attached. https://en.wikipedia.org/wiki/Distributed.net

Exactly the same thing happens with the Bitcoin puzzle series: the author publishes addresses whose private keys are missing n bits and dares anyone to brute-force the rest. Puzzle #66, holding 6.6 BTC, was solved nine months ago when someone enumerated the remaining 66 bits, textbook brute-force and nobody questioned the solver’s right to sweep the coins. https://www.linkedin.com/posts/thomas-wiesner_bitcoin-crypto-puzzle-activity-7241496381549404160-XQXG

So yes, courts decide authorization, but in these cases the authorization is the public challenge itself. Calling that process anything other than “brute-forcing” doesn’t make you sound legal-savvy, it just shows you’ve skipped the last thirty years of cryptography history.

So, if you work in cybercrime investigation, I'm the queen of England.

Benjade

Posts

Merits