I'd be surprised if 30 years into the future (probably earlier given the incentives we have to break crypto today are so much than those we had in '98) if these algorithms weren't broken.
There is actually no precedent of a cryptographic system relying on computational hardness surviving for more than a generation. And given that our fundamental theoretical understanding hasn't really evolved beyond, "we think a bunch of these problems are hard", things are likely to stay that way for a while.
>There is actually no precedent of a cryptographic system relying on computational hardness surviving for more than a generation.
That's because cryptosystems relying on computational hardness aren't that old.
>And given that our fundamental theoretical understanding hasn't really evolved beyond, "we think a bunch of these problems are hard", things are likely to stay that way for a while.
These assumptions haven't really broken though. You give an example of DES, but that doesn't rely on computational hardness assumptions. Asymmetric crypto with a trapdoor function does. There hasn't even been a big breakthrough in the original prime number factorization assumptions of RSA/DH.
Similarly, if you found had preimage attack for ripemd160(sha256(x)) (you can find a public key with the same hash as any other hash), how could you not steal people's money?
If you found pre-image for ripemd160(sha256(x)), you still need to find a private key for it.
In block B, I make a transaction h -> 1 BTC -> s. Where s is a securely generated public key that I own. I then sign this transaction with my forged public key, which hashes to h.
How does this not give me x's money?
Obviously when RSA's end nears, assuming bitcoin is still around then, we'll see some sort of managed transition to a newer cryptosystem. I imagine the network will probably support announcing transactions saying something like, "Wallet X will now be known as wallet Y" where Y uses the new cryptosystem. And presumably only the first valid signed announcement will count and make its way into the block chain. It's at this point that I think people with enough compute power might be able to "steal" lost wallets.