Bitcoin address is a hash of public key. So, without address reuse you should break both EC, RIPEMD-160 and SHA-256
I'd be surprised if 30 years into the future (probably earlier given the incentives we have to break crypto today are so much than those we had in '98) if these algorithms weren't broken.
There is actually no precedent of a cryptographic system relying on computational hardness surviving for more than a generation. And given that our fundamental theoretical understanding hasn't really evolved beyond, "we think a bunch of these problems are hard", things are likely to stay that way for a while.
>There is actually no precedent of a cryptographic system relying on computational hardness surviving for more than a generation.
That's because cryptosystems relying on computational hardness aren't that old.
>And given that our fundamental theoretical understanding hasn't really evolved beyond, "we think a bunch of these problems are hard", things are likely to stay that way for a while.
These assumptions haven't really broken though. You give an example of DES, but that doesn't rely on computational hardness assumptions. Asymmetric crypto with a trapdoor function does. There hasn't even been a big breakthrough in the original prime number factorization assumptions of RSA/DH.
Similarly, if you found had preimage attack for ripemd160(sha256(x)) (you can find a public key with the same hash as any other hash), how could you not steal people's money?
If you found pre-image for ripemd160(sha256(x)), you still need to find a private key for it.
In block B, I make a transaction h -> 1 BTC -> s. Where s is a securely generated public key that I own. I then sign this transaction with my forged public key, which hashes to h.
How does this not give me x's money?