>Can't I check the blockchain for all transactions around the time that the informant sent the bounty and just brute-force that

Do check in from your private island after you finish doing so, since the next transaction on the blockchain you will brute force is presumably this one:

http://www.coindesk.com/194993-btc-transaction-147m-mystery-...

Being more serious, it should be emphasized that you're not by any means brute forcing Bitcoin transactions when you're doing this. He's just using a clever technique composed of crypto hash chains to hide a Bitcoin private key. It just happens to use the same SHA256 algo as Bitcoin mining does.

Ah, the public Bitcoin key is not the secret, it's the hash of the secret. I thought the secret was the address itself.

You don't need to monitor all the transactions in the block chain. The attacker gives you the exact address containing the bounty (hashed_secret). There is no extra information in the block chain that would make brute forcing easier. And brute forcing the public key directly is computationally unfeasible (O(2^256) complexity).

A Bitcoin (ECDSA) private address is a 256-bit binary blob: priv_key

The corresponding ECDSA public key is either represented as <x><y> (curve coordinates, "uncompressed format") or <sign><y> ("compressed format"): pub_key

A Bitcoin address (eg. 1BGbGFBhsXYq6kTyjSC9AHRe1dhe76tD6i) is basically: base58(RIPEMD160(SHA256(pub_key))), plus a version byte, plus a 16-bit checksum

So the "secret" is: SHA256(pub_key) And the "hashed_secret" is: RIPEMD160(SHA256(pub_key))

Right, I misunderstood and thought they were using "secret" for the public Bitcoin address, thanks.