We're searching for Bitcoin wallets generated with weak entropy from 2009-2012 — here's what early wallet software got wrong

Between 2009 and 2012, Bitcoin wallet software was experimental. Many early tools used predictable random number generators to create private keys:

- Debian OpenSSL bug (CVE-2008-0166) — A catastrophic bug shipped in 2008 reduced all randomness to just the process ID. Only 65,536 possible private keys. Any wallet generated on Debian/Ubuntu during that period is trivially crackable.

- Timestamp-seeded LCGs — glibc and MSVC srand(time(NULL)) followed by rand() to generate each byte of the private key. The entire search space is just ~62.8 million seeds (one per second from genesis to early 2011).

- Randstorm (V8 MWC1616) — BitcoinJS and other web-based wallets relied on Chrome's Math.random(), which used a weak PRNG before 2013. Disclosed by Unciphered in 2023, this affected wallets created through browser interfaces.

- Brain wallets — SHA256("password"), SHA256("1"), SHA256("12345") — people actually did this, and the keys are still sitting on-chain.

- Java LCG — Early Android wallets (BitcoinJ) seeded java.util.Random with millisecond timestamps.

There are roughly 2,845 known funded addresses believed to have been created by these weak methods.

We built a distributed GPU project to systematically search through all 23 weak key patterns. The pipeline runs entirely on CUDA — each GPU thread generates a private key using the weak algorithm, does the full secp256k1 multiplication, SHA-256, RIPEMD-160, and checks against

all target addresses via a bloom filter. An RTX 3090 tests ~130 million keys per second.

The small keyspaces are already exhausted (Debian OpenSSL was done in milliseconds). We're currently grinding through SHA-256 of sequential integers — a 2^64 keyspace that will take sustained GPU power.

How rewards work if a wallet is found:

- 70% distributed to GPU contributors based on verified compute time

- 20% to platform development and infrastructure

- 10% donated to medical research

Website with live stats and the full technical writeup: https://b4q.io

Curious if anyone here remembers using any of these early wallet tools. Some of these bugs were well-known at the time but the affected addresses are still funded years later.