> Once we achieve quantum supremacy, is it still impossibly hard to break the private keys?

Yes, because there are mitigations in place (since day one I believe). When you send bitcoin to an address, you don't send to a public key, you send to a hash of a public key. It's only when you need to spend the coins that you need to disclose the public key. According to wikipedia hash functions are considered safe against attacks against quantum computers[1] so any coins stored in addresses that haven't been spent from before should be safe. There's still potentially a window of vulnerability between when a transaction is broadcast and when it's confirmed, but I doubt quantum computers offer enough of a speed-up that it can crack a 256 bit secp256k1 key within an hour or two.

[1] https://en.wikipedia.org/wiki/Post-quantum_cryptography

There are millions of bitcoins in outputs with known public keys, either from older P2PK, or from address re-use.

> Once we achieve quantum supremacy, is it still impossibly hard to break the private keys?

The only actually-working-worth-a-damn quantum tech is annealing, which won't run Shor's algorithm. All the rest of the NISQ work for gate-model quantum computing is limited to less than a hundred qubits so far and with the "logical qubit" error correcting requirements, it's going to take millions of those qubits before we can get to breaking RSA keys of any length used in the last decade.

I wouldn't worry about this one anytime soon.

> Could a state actor or motivated rich person burn $10M or $100M to steal the biggest wallet?

You could burn $100M on a moonshot to steal it with no guarantee of success. It's almost like trying to win the lottery by buying a ton of tickets, except the space of all possible options is bigger. Lotteries are something like 300 million combinations; 2048 bit RSA is something like a 600+ digit number, though your cost per play is obviously lower and you can iterate quickly.

You wouldn't want to go after just one wallet, of course; you'd probably want to have a big battery of large wallets to test each combination against. Still, doesn't raise your chances by much. If you have a 10 million core supercomputer and you can test, say, 100 million combinations per second, you're still looking at a 600-digit number of years to work your way through it.

I don't think you'd need to target specific wallets, you'd probably just generate a ton of keys and match them against any known wallets.

As of today there are 68,446,700 unspent transaction outputs. Meanwhile there are approximately 2^256 possible private keys, so testing against any known wallets doesn't achieve any meaningful increase in your odds.

It’s possible... but I think someone will just use a 50 dollar handgun to achieve the same.

If one was to set this up to short bitcoin and/or destroy trust, stealing is not the point.

The point is to prove you can do it to even the most secure wallets remotely without ever interacting with another human.

If it happened, nobody with bitcoin holdings valued over the opportunity cost of breaking the crypto would be safe.