Bitcoin's proof of work has done around 2^96 hashes over all time. Breaking the ZKP's in Zcash requires a minimum of 2^120 elliptic curve operations assuming ECDLP. If you had a dedicated ASIC, an elliptic curve addition would cost around 10-100x more than SHA2. So today breaking an Elliptic curve would cost around 1 billion Bitcoin-hashrate equivalents. AKA a billion times the hardware buildout of all Bitcoin mining ASICs, dedicated to break this. If a hypothetical billion X improvement came in, you'd need a chip buildout on the level of bitcoin mining before you can break anything. While competing against all the hyperscalars for fab-space. AKA plenty of warning time, for a recovery process that takes a couple day response time max.