There are two different things: elliptic curves like secp256k1, and hash functions like SHA-256. If you break only elliptic curves, then the network can move to a different algorithm, while still using SHA-256 as usual. However, if you break SHA-256, then you can break everything, including mining, and then, it is a completely different situation. Breaking SHA-256 will also break secp256k1, if you would be able to generate any preimages, because then, you could start from any known public key, generate (r,s,z) values randomly, which would match it, and then generate a transaction, which would hash into that random z-value. Also, even finding collisions for SHA-256 would be harmful, because then, you could create colliding merkle tree branches, where one transaction would send coins from Alice to Bob, and another transaction would do that from Alice to Charlie, and both would hash to the same value, which would hash to the same merkle root. When you create a private or public key from the seed, then hashing is used in-between, specifically for example HMAC-SHA512 from BIP-32, where SHA-512 is used. Yes. And it has a drawback, that should be clearly stated: if a given key is not coming from any HD wallet, but is just generated randomly, for example by OpenSSL, like it was done in early days. In these cases, if committing to the seed would be always required, then these coins would be as hard to access, as coins from "Win79 Rtp eater": because it would then require finding a seed, where none is known. Which is why that kind of solutions are technically possible, but it is hard to reach consensus, if there is a risk of blocking someone's coins, if that person didn't use any seed at all.
There are two different things: elliptic curves like secp256k1, and hash functions like SHA-256. If you break only elliptic curves, then the network can move to a different algorithm, while still using SHA-256 as usual. However, if you break SHA-256, then you can break everything, including mining, and then, it is a completely different situation. Breaking SHA-256 will also break secp256k1, if you would be able to generate any preimages, because then, you could start from any known public key, generate (r,s,z) values randomly, which would match it, and then generate a transaction, which would hash into that random z-value. Also, even finding collisions for SHA-256 would be harmful, because then, you could create colliding merkle tree branches, where one transaction would send coins from Alice to Bob, and another transaction would do that from Alice to Charlie, and both would hash to the same value, which would hash to the same merkle root. When you create a private or public key from the seed, then hashing is used in-between, specifically for example HMAC-SHA512 from BIP-32, where SHA-512 is used. Yes. And it has a drawback, that should be clearly stated: if a given key is not coming from any HD wallet, but is just generated randomly, for example by OpenSSL, like it was done in early days. In these cases, if committing to the seed would be always required, then these coins would be as hard to access, as coins from "Win79 Rtp eater": because it would then require finding a seed, where none is known. Which is why that kind of solutions are technically possible, but it is hard to reach consensus, if there is a risk of blocking someone's coins, if that person didn't use any seed at all.

There are two different things: elliptic curves like secp256k1, and hash functions like SHA-256. If you break only elliptic curves, then the network can move to a different algorithm, while still using SHA-256 as usual. However, if you break SHA-256, then you can break everything, including mining, and then, it is a completely different situation. Breaking SHA-256 will also break secp256k1, if you would be able to generate any preimages, because then, you could start from any known public key, generate (r,s,z) values randomly, which would match it, and then generate a transaction, which would hash into that random z-value. Also, even finding collisions for SHA-256 would be harmful, because then, you could create colliding merkle tree branches, where one transaction would send coins from Alice to Bob, and another transaction would do that from Alice to Charlie, and both would hash to the same value, which would hash to the same merkle root. When you create a private or public key from the seed, then hashing is used in-between, specifically for example HMAC-SHA512 from BIP-32, where SHA-512 is used. Yes. And it has a drawback, that should be clearly stated: if a given key is not coming from any HD wallet, but is just generated randomly, for example by OpenSSL, like it was done in early days. In these cases, if committing to the seed would be always required, then these coins would be as hard to access, as coins from "Win79 Rtp eater": because it would then require finding a seed, where none is known. Which is why that kind of solutions are technically possible, but it is hard to reach consensus, if there is a risk of blocking someone's coins, if that person didn't use any seed at all.

There are two different things: elliptic curves like secp256k1, and hash functions like SHA-256. If you break only elliptic curves, then the network can move to a different algorithm, while still using SHA-256 as usual. However, if you break SHA-256, then you can break everything, including mining, and then, it is a completely different situation. Breaking SHA-256 will also break secp256k1, if you would be able to generate any preimages, because then, you could start from any known public key, generate (r,s,z) values randomly, which would match it, and then generate a transaction, which would hash into that random z-value. Also, even finding collisions for SHA-256 would be harmful, because then, you could create colliding merkle tree branches, where one transaction would send coins from Alice to Bob, and another transaction would do that from Alice to Charlie, and both would hash to the same value, which would hash to the same merkle root. When you create a private or public key from the seed, then hashing is used in-between, specifically for example HMAC-SHA512 from BIP-32, where SHA-512 is used. Yes. And it has a drawback, that should be clearly stated: if a given key is not coming from any HD wallet, but is just generated randomly, for example by OpenSSL, like it was done in early days. In these cases, if committing to the seed would be always required, then these coins would be as hard to access, as coins from "Win79 Rtp eater": because it would then require finding a seed, where none is known. Which is why that kind of solutions are technically possible, but it is hard to reach consensus, if there is a risk of blocking someone's coins, if that person didn't use any seed at all.