Pubkeys are protected by a dual construction of SHA-256 and RIPEMD-160, resulting in 80 bits of keyspace in a post-quantum world (assuming that existing quantum constructions can be extended into this dual-hash-of-ecdsa-key construction, which is not at all clear).
/nitpick
I always forget about the RIPEMD-160 step. The bitcoin wiki claims that it's strictly more profitable to mine than to search for collisions, but it seems to me that that's a function of block reward vs. value of address you're trying to hack, so I don't know if I believe that. https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses
It's unclear to me how you would actually implement this in a quantum computer; do you have to essentially build a set of quantum gates that implement RIPEMD-160(SHA256(pubkey))? Does this imply you need enough qubit...