> Once we achieve quantum supremacy, is it still impossibly hard to break the private keys? The only actually-working-worth-a-damn quantum tech is annealing,

> Once we achieve quantum supremacy, is it still impossibly hard to break the private keys? The only actually-working-worth-a-damn quantum tech is annealing, which won't run Shor's algorithm. All the rest of the NISQ work for gate-model quantum computing is limited to less than a hundred qubits so far and with the "logical qubit" error correcting requirements, it's going to take millions of those qubits before we can get to breaking RSA keys of any length used in the last decade. I wouldn't worry about this one anytime soon. > Could a state actor or motivated rich person burn $10M or $100M to steal the biggest wallet? You could burn $100M on a moonshot to steal it with no guarantee of success. It's almost like trying to win the lottery by buying a ton of tickets, except the space of all possible options is bigger. Lotteries are something like 300 million combinations; 2048 bit RSA is something like a 600+ digit number, though your cost per play is obviously lower and you can iterate quickly. You wouldn't want to go after just one wallet, of course; you'd probably want to have a big battery of large wallets to test each combination against. Still, doesn't raise your chances by much. If you have a 10 million core supercomputer and you can test, say, 100 million combinations per second, you're still looking at a 600-digit number of years to work your way through it.