Imagine a situation where there are many high-value public keys around, using the same Elliptic Curve group, say $k$ in the millions public keys¹. Can an adversary reasonably find one of the matching private key at much lower cost that finding the private key for a particular one?

What's the best feasible method? What's it's cost relative to the best known feasible method for one key (that is, I believe, distributed Polard's rho with distinguished points), as a function of $k$ and perhaps the Elliptic Curve group order $n$?

¹ Imagine Bitcoin with secp224k1, and the corresponding ponzi had similar market value.

Imagine a situation where there are many high-value public keys around, using the same Elliptic Curve group, say $k$ in the millions public keys¹. Can an adversary reasonably find one of the matching private key at much lower cost that finding the private key for a particular one?

What's the best feasible² method? What's it's cost relative to the best known feasible method for one key (that is, I believe, distributed Polard's rho with distinguished points), as a function of $k$ and perhaps the Elliptic Curve group order $n$?

¹ Imagine Bitcoin with secp224k1, and the corresponding ponzi had similar market value.

² Assuming known existing technologies, including supercomputers, GPUs, FPGAs, ASICs, but not quantum computers usable for cryptanalysis.