I always forget about the RIPEMD-160 step. The bitcoin wiki claims that it's strictly more profitable to mine than to search for collisions, but it seems to me that that's a function of block reward vs. value of address you're trying to hack, so I don't know if I believe that. https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses
It's unclear to me how you would actually implement this in a quantum computer; do you have to essentially build a set of quantum gates that implement RIPEMD-160(SHA256(pubkey))? Does this imply you need enough qubits to hold all stages of the calculation in memory at the same time? I haven't been able to figure out from wikipedia how I'd arrange qubits to do a single hashing operation. Given that it's a lot of sequential steps, perhaps it actually takes a lot of qubits chained together?
do you have to essentially build a set of quantum gates that implement RIPEMD-160(SHA256(pubkey))?
Actually RIPEMD-160(SHA-256(pubkey(privkey))).
Does this imply you need enough qubits to hold all stages of the calculation in memory at the same time?
That's a massive understatement. Grover's algorithm can be used to reverse either RIPEMD-160 or SHA-256 with sqrt speedup. In principle it should also handle RIPEMD-160(SHA-256(x)), just with a lot more qubits. Shor's algorithm can be used to reverse the pubkey-from-privkey step. I'll hand-wave and pretend...