<p>By checking the <a href="https://bitcoin.stackexchange.com/questions/26869/what-is-chainwork">chainwork</a>, which shows the total hashes that are expected to be calculated. As of block 765365, it's <code>00000000000000000000000000000000000000003a8a576dba35308e77dc8446</code>.</p>
<p>In decimal, that's 18,117,375,202,741,628,848,220,608,424.</p>
<p>Satoshi used P2PK back in 2009, so there is only one valid Bitcoin private key that can sign for the corresponded rewarded public key. Therefore, you have 1 in 2^256 - 2^32 - 977, which is <em>far</em> larger number.</p>
<p>In decimal, it's 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,908,834,671,663.</p>
<p>But, to be fair, calculating SHA256d hashes of block headers, and brute forcing private keys aren't the same computational processes, economically speaking.</p>

CC BY-SA 4.0
2022-11-30T22:29:28.047Z
Computing the private key for a given public key needs only ~2^128 group operations, roughly the square root of the number of valid private keys, using algorithms like Pollard's rho. Also, the number of valid private keys is 2^256 - 432420386565659656852420866394968145600, not 2^256 - 2^32 - 977 (which is the size of the field the secp256k1 group is defined over).
Pieter Wuille
CC BY-SA 4.0
2022-11-30T22:10:34.703Z
2022-11-30T22:10:34.703Z
Angelo
<p>If I am not mistaken you could in theory revert the entire blockchain, by producing nonces which probabilistically speaking required more work.
So the (hypothetical) question is: if I wanted to steal Satoshi's Bitcoin, should I try to guess the private key or create a new chain with more work?
Set aside the economic implications of the value of Bitcoin in either case, purely probabilistically speaking, how do the two compare?</p>

<private-key><proof-of-work>
Is it easier to reverse the entire blockchain than to guess a private key?
MManke
# Is it easier to reverse the entire blockchain than to guess a private key?

(Asked by: username_0 on 2022-11-30)

If I am not mistaken you could in theory revert the entire blockchain, by producing nonces which probabilistically speaking required more work.
So the (hypothetical) question is: if I wanted to steal Satoshi's Bitcoin, should I try to guess the private key or create a new chain with more work?
Set aside the economic implications of the value of Bitcoin in either case, purely probabilistically speaking, how do the two compare?

**Tags:** private-key, proof-of-work


---

## 1 answers

### Answer by username_1 on 2022-11-30. Score: 1 | Accepted answer

By checking the [chainwork](https://bitcoin.stackexchange.com/questions/26869/what-is-chainwork), which shows the total hashes that are expected to be calculated. As of block 765365, it's `00000000000000000000000000000000000000003a8a576dba35308e77dc8446`.

In decimal, that's 18,117,375,202,741,628,848,220,608,424.

Satoshi used P2PK back in 2009, so there is only one valid Bitcoin private key that can sign for the corresponded rewarded public key. Therefore, you have 1 in 2^256 - 2^32 - 977, which is *far* larger number.

In decimal, it's 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,908,834,671,663.

But, to be fair, calculating SHA256d hashes of block headers, and brute forcing private keys aren't the same computational processes, economically speaking.

> **Comments:**
> **username_2**: Computing the private key for a given public key needs only ~2^128 group operations, roughly the square root of the number of valid private keys, using algorithms like Pollard's rho. Also, the number of valid private keys is 2^256 - 432420386565659656852420866394968145600, not 2^256 - 2^32 - 977 (which is the size of the field the secp256k1 group is defined over).  

---

