Imagine a situation where there are many high-value public keys around, using the same Elliptic Curve group, say $k$ in the millions public keys¹. Can an adversary reasonably find one of the matching private key at much lower cost that finding the private key for a particular one?

What's the best feasible method? What's it's cost relative to the best known feasible method for one key (that is, I believe, distributed Polard's rho with distinguished points), as a function of $k$ and perhaps the Elliptic Curve group order $n$?
___

¹ Imagine Bitcoin with [secp224k1][1], and the corresponding ponzi had similar market value.


  [1]: https://www.secg.org/sec2-v2.pdf#subsubsection.2.3.1