As I understand it, they are basically private keys. The idea is to find the wallet address that they go with. Once that is done, the winner can create a transaction that sends the contents of the wallet to their own as a prize.
This would normally be computationally intractable but these keys are much smaller than normal, with most of their leading digits intentionally zeroed out to make it easier to 'steal' the funds from the corresponding wallet. If anyone knows who set this up, or why, they aren't talking.
In the process of creating the transaction to claim the prize, the winner must generate a corresponding public key based on some sort of hash of the private key and wallet address. I don't know how they can tell when they've succeeded; hopefully someone else can clarify/correct this point. But once they do succeed, the transaction is then posted in public to allow miners to add it to the blockchain.
Unfortunately, due to mathematical witchfuckery, knowledge of both the private key and a valid public key makes it possible to solve the puzzle as if the already-shortened private key had half the number of bits. In that case, finding the wallet address might take only a minute or two on a standard GPU rather than the months of time on a whole warehouse full of them that the original winner had to spend.
Knowing this, people who are bad and who should feel bad set up bots to watch for the prize-claiming transactions. The bots are designed to recompute the source wallet address independently and front-run the winner's transaction by resubmitting it for the benefit of the thief, using a higher reward to incentivize miners to prioritize their transaction over their original one. Bitcoin blocks are mined about every 20 minutes, so on average the thief has about 10 minutes to create an overriding transaction once the original transaction is posted. Sucks to be the winner who expended so much effort to claim the prize, as they are now out about $400K. Nothing left but a huge electric bill.