512 / j
Variants tested
Powers of two mod n + cumulative sums, both signs.
v0.1 · research preview
GPU-accelerated
GPU-accelerated
secp256k1 key discovery,
on Apple Silicon.
greedy-find is a research-grade Metal pipeline that searches a bounded, known range of secp256k1 private keys for one whose public key or address matches a target. Multi-variant range-splitting, batch inversion, and an atomic match buffer — designed for native M-series performance.
Built for
Apple Silicon macOS 14+ Metal 3.0 Xcode 16+ secp256k1 MIT licensed
v0.1.0 · 2026 release
At a glance
The numbers behind the sweep.
The hard parts are not the math, they're the plumbing. Here's how the v0.1 pipeline expresses itself in numbers.
×32
Batch inversion
One inversion for 32 lanes via Montgomery's trick.
2⁶⁴
Range ceiling
v0.1 refuses anything larger — explicit, not silent.
M-series native
Throughput target
Metal 3.0 compute, designed for Apple Silicon.
Product overview
A research-grade GPU sweep
A research-grade GPU sweep
that thinks in ranges, not keys.
Most keyspace tools either brute-force the impossible 2²⁵⁶ or take shortcuts that break the math. greedy-find sits in a third place: it searches a known, bounded range — like a Bitcoin Puzzle slice — and uses Metal compute to test millions of candidate scalars per second against a compressed public-key or P2PKH address.
Every step is observable. Variant tables, anchor chains, the prune bitmap, and the atomic match buffer are first-class outputs, not implementation details — so a researcher can verify what ran, why it matched, and what the host saw.
- Bounded-range sweep. Pass
--fromand--to, the GPU walks every j in [from, to). - Two target modes. Compressed SEC1 pubkey (X-coordinate) or P2PKH mainnet address (hash160).
- Multi-variant splitting. 512 candidate offsets per j — both signs, powers-of-two and cumulative.
- Resumable sessions. SHA-256-verified checkpoints, NDJSON telemetry, deterministic replay.
What you get Nine things it does
Nine things it does
that other keyspace tools don't.
A focused surface, not a kitchen sink. Each feature exists because someone needed it during a real sweep — and ships behind a flag, a KAT, or a benchmark gate.
Metal 3.0 compute
Native compute kernels for Apple Silicon — variant pruning, the sweep itself, and a simdgroup-flavoured batch inversion for the affine back-conversion.
M-series throughput
32-lane threadgroups, batched EC-add chains, anchor-table precomputation — measured in millions of keys per second on M-series hardware.
512-variant splitting
Both signs of every power of two mod n, plus the cumulative sums. Every j is tested against 512 candidate offsets before the kernel moves on.
Atomic match recovery
A small per-device atomic match buffer — matches are written once, recovered once, and never silently lost. A simdgroup variant is gated on a ≥5% bench win.
Resumable sessions
Periodic checkpoints with SHA-256 integrity hash. On `--resume`, the host verifies the file and reattaches the sweep from the saved position.
Bounded by design
Research-grade. v0.1 refuses P2SH, refuses ranges > 2⁶⁴, refuses signed inputs. The threat model is documented in `docs/security.md`.
NDJSON events
One event per line: slice start/end, match, telemetry. Stream the file into anything that reads NDJSON, or open it in your editor.
First-class docs
Algorithm, architecture, CLI, configuration, and security docs all live alongside the source — short, exact, no marketing fluff.
Open by default
MIT licensed. KAT-tested on every commit. Differential-tested against the CPU Rust `find` crate so the math stays portable.
Architecture
A small, honest pipeline
A small, honest pipeline
from argv to atomic match.
The host owns parsing, the variant table, the anchor table, dispatch, and recovery. The device owns the inner loop. No magic, no hidden state, no surprises — every buffer is observable, every dispatch is reproducible.
GRDRunSession parses argv
into a GRDOptions struct and dispatches to a mode-specific sweeper.
Variants are precomputed once per device using libsecp256k1. The sweep kernel does
per-lane scalar muls and EC adds; matches are written to a small atomic match buffer
per device.
512
variants / j
×32
batch inversion
2⁶⁴
range ceiling
Command line One command,
One command,
a bounded sweep.
Build it once, then point it at a target. The CLI is honest about what it can and can't do — signed inputs are refused, out-of-range values are refused, address-mode GPU is gated behind a clear "lands in A40+" message.
zsh — greedyfind session
Status Honest progress,
Honest progress,
measured by benchmarks.
No version numbers, no marketing-roadmap shapes. Each feature ships behind a KAT, a differential test, or a ≥5% bench gain over the unoptimised baseline.
Shipped · v0.1 live
pubkey-mode GPU sweep
SEC1 X-coordinate sweep over an arbitrary [from, to) range on Apple Silicon via Metal.
SEC1 X-coordinate sweep over an arbitrary [from, to) range on Apple Silicon via Metal.
Host-side reference math
Field/point arithmetic in host/ecc.c — used by the KAT suite as the canonical oracle.
Field/point arithmetic in host/ecc.c — used by the KAT suite as the canonical oracle.
KAT suite
Field ops, hash160, base58check decode, address parsing, variant generation, load balance, telemetry, checkpointing.
Field ops, hash160, base58check decode, address parsing, variant generation, load balance, telemetry, checkpointing.
Reliability + differential
scripts/reliability.sh runs the matrix; scripts/differential.sh cross-checks against the `find` Rust crate.
scripts/reliability.sh runs the matrix; scripts/differential.sh cross-checks against the `find` Rust crate.
In progress A40+
Address-mode GPU sweep
Stub returns "A40+" — full hash160 path is the current A40 unit; gated on a ≥5% bench win.
Stub returns "A40+" — full hash160 path is the current A40 unit; gated on a ≥5% bench win.
Cache layer
GRDCache plumbing exists; integration with the sweep pipeline is on the roadmap.
GRDCache plumbing exists; integration with the sweep pipeline is on the roadmap.
Simdgroup batch inversion
A40 simdgroup variant — faster affine back-conversion, measured against the unoptimised baseline.
A40 simdgroup variant — faster affine back-conversion, measured against the unoptimised baseline.
Roadmap queued
u128 ranges > 2⁶⁴
v0.1 decodes only the low 64 bits of j. Full u128 decode is queued behind address-mode.
v0.1 decodes only the low 64 bits of j. Full u128 decode is queued behind address-mode.
P2SH addresses (0x05)
Rejected in v0.1 with a clear error. Lands alongside address-mode.
Rejected in v0.1 with a clear error. Lands alongside address-mode.
Distributed slicing
Cooperative multi-host sweeps with per-slice NDJSON merge — already informally supported via checkpoints.
Cooperative multi-host sweeps with per-slice NDJSON merge — already informally supported via checkpoints.
Throughput optimisations
A40–A44 batch features are individually gated; each ships only if it earns its bench.
A40–A44 batch features are individually gated; each ships only if it earns its bench.
Get started Build it in two commands.
Build it in two commands.
Run a sweep in five.
CMake configures the host, the Metal kernels, the tests, and the bench harness in one pass. The smoke script asserts both modes. The KATs run on every commit.
# build
cmake -S . -B build
cmake --build build -j
# smoke test (both modes)
bash examples/run.sh
cmake -S . -B build
cmake --build build -j
# smoke test (both modes)
bash examples/run.sh