Okay, you're right. Pick any timespan you want, say, one year. A powerful attacker would be one that can find factors by ECM up to 768 bits and factor numbers up to 2048 bits by GNFS in one year. Such an attacker would then have a ~20% chance of factoring any one of those UFOs in that timespan. Assuming the capacity does not change, in 13 years, the attacker would have had a 1 in a billion chance of factoring all of them, because the attacker would have had enough time to be able to try all 13 in that time. Does that make sense?

Again, I should point out that this attacker would be far beyond what even the NSA is likely to be able to do for decades.


Yes, with a software upgrade (a hard fork). The new software would require that all newly minted zerocoins use the new UFO set. We give everyone, say, a one year deadline to mint all zerocoins in the old UFO set back into ANC (obviously it should be announced repeatedly, in as many places online as possible), and after that year, zerocoins can only be spent from the new UFO set.