The referenced paper is from 2009 and points out a complexity of 2^123 (or roughly 10^27). Bitcoin miners currently put out ~150 EH/s, so about 10^17. Only judg

The referenced paper is from 2009 and points out a complexity of 2^123 (or roughly 10^27). Bitcoin miners currently put out ~150 EH/s, so about 10^17. Only judged by the rounds, double-sha256 (Bitcoin) has 128 and md5 has 4, so let's assume they'd do 10^18 hashes per second on md5. So it would take them about 31 years to find a collision. If the NSA found a way to get the complexity down a bit more (they had a decade) and the target is valuable enough (imagine, for example, having a "valid" TrueCrypt executable), this is not in the realm of impossible anymore. Now, of course, the NSA will probably not outcompute the Bitcoin blockchain and transfering the hash rate is not that simple, but they do have a lot of power and cryptographers. What I'm trying to say is that the orders of magnitude are not in the "totally impossible" space anymore. Yes, you're probably safe, but given the availability of secure alternatives, there's really no reason not to get off the thin ice.