user5: Bitcoin users frequently generate new addresses for each transaction they make, which greatly increases the number of bitcoin addresses being used to receive money.
Would it be possible (and profitable) for someone to find collisions in the bitcoin address space in order to steal money?

user56: Possible: Yes.
Probable: No.
Many events are possible even though they're not probable. The likelihood of bruteforcing a bitcoin private key is improbable enough that with current computing standards it is, for all intents and purposes, impossible.
As the science of cryptography develops and as bruteforcing becomes more powerful the underlying bitcoin infrastructure will be improved to keep pace with the improving technology. This may require accessing your bitcoin wallet using an improved client in the future to maintain a high standard of security.
Additionally, a bitcoin address is not the same as a private key. Generating a bitcoin address will allow an attacker to send you coins, but it would not allow them to sign transactions with your private key (i.e. remove coins from your wallet).

user14: Theoretically it is possible (but not profitable).  But in reality the amount of money you would have to spend to do it would be a lot more than what you would make.

user13336: If you prefer diagrams: http://i.imgur.com/ag3KQ0L.png (there are more addresses in the address space than there are zeptometres, 1/1 000 000 000 000 000 000 of a metre, in the universe's width).
If you prefer maths: http://download.wpsoftware.net/bitcoin-birthday.pdf (by Andrew Poelstra) says (slightly edited):

Using [birthday attack maths], we calculated [above] that for a 0.1% probability of collision, we would need 5.4 × 10^22 addresses in existence. For a 99.9999% chance, we would need 6.35 × 10^24 addresses.
So, even if there were 10^22 bitcoin addresses generated, a collision simply will not happen.  But if there were 10^25 addresses generated, a collision absolutely would happen.
Should we worry about this?  No, for these independent reasons:

The chance of getting a specific collision, say, a collision with one of your addresses, is still 1 in 2^160 or 1 in 10^48 . So even if you've got a million million million addresses, nobody has a chance of colliding with you.
At the time of this writing, there are less than 10^7 addresses in use in the network.  So anyone with 10^25 addresses would only be colliding their own addresses.
Each address takes around 100 bytes to store. (Actually about half that, but we only care about orders of magnitude.) So for the network to support 10^25 addresses, it would take 10 million million terabytes of storage just to record them.  (And this is not even touching the problem of searching such a huge data store.
According to sipa, if the current mining network (which is at 25 THash, and the most powerful computing network in the history of the world) were switched over to address generation, the network could generate 2.5 × 10^12 addresses per second (one address generation corresponding to roughly 10 hashes). At that rate, it would take 127,000 years to get so many addresses. It is debatable whether homo sapiens has walked the earth for that long.
With 21 million bitcoins ever existing, and 8 decimal places of divisibility, at most 2.1 × 10^14 can possibly have money on them at once.  But in a space of 10^24 addresses, this means that only one in 10^12 addresses could possibly have money on them. So an attacker, after doing the physically impossible 3 trillion times over, has only a one in a trillion chance of getting even one satoshi out of it.



user64340: There is the LBC (Large Bitcoin Collider) project that attempts to do that. According to their website they've created over 8,000 trillion keys, as of October 2017.
According to a Motherboard article of April 2017, LBC found over 30 Bitcoin private keys. 

user30076: If you would like to see some proof to verify that it is truly quite impossible to generate a known keypair, you could test this yourself, if you wanted.
Pavol Rusnak has created coinkit, a python library for interacting with Bitcoin related stuff. In there, there is an example on how to use it that does exactly what you are asking.
What it does is it generates a random keypair and searches blockchain.info for a balance.
I let it run about a month ago with slight modifications on about 1mio adresses and did not find a single one colliding.

user53: No, it is not possible, for two reasons.
First, you would have to generate and hash an unimaginably large number of ECDSA keypairs to have a reasonable chance of finding a collision. With current computing power, that would take longer than the age of the universe.
Second, as pointed out in the other answers it is much more profitable to generate bitcoins if you have lots of computing power.

user1083: In order to spend money sent to a Bitcoin address, you just need to find a ECDSA public key that hashes to the same 160-bit value. That will take, on average, 2160 key generations.
Supposing you could generate a billion (230) per second, you need 2130 seconds.
Doing this in parallel using a billion machines requires only 2100 seconds.
Getting a billion of your richest friends to join you gets it down to only 270 seconds.
There are about 225 seconds per year, so you need 245 years.
The age of the Universe is about 234 years so far — better get cracking!

user22: It may be "theoretically" possible, but in reality it's unlikely to be achieved - As in counting the number of atoms in an office building unlikely.
Bitcoin addresses are actually the 256-bit SHA hash of an ECDSA public key, so any vulnerabilities in those algorithms would constitute a vulnerability in bitcoin itself. Realistically, however, breaking this level of encryption requires a huge amount of processing power. Coincidentally it requires precisely the same kind of processing power that bitcoin mining requires and in almost every scenario it would be massively more profitable to mine than to hack.
Edit: It's actually RIPEMD-160(SHA-256(public key)) as opposed to just SHA-256(public key) as I originally mentioned, so it's a 160-bit hash of a 256-bit hash of a public key. While the target keyspace (160 bits) is smaller thanks to this final step, it's also an additional computation that a would-be hacker must make. While the additional computational complexity doesn't even come close to canceling out the removal of 96 bits of keyspace, it should be noted that finding a collision in a 160-bit keyspace is still incredibly difficult and time consuming. More importantly, it is more difficult and time consuming than actually mining the same number of coins would be, thus making it highly unlikely anyone would even attempt such an attack - even if the equipment to make such an attack plausible in a meaningfully small span of time existed.

user659: It is possible to brute force some Bitcoin addresses, because some people generate their private keys in an insecure manner.  Any (non-zero) 32 bytes can be a private key.  So running sha256 over a passphrase gives an apparently random, but brute force-able private key.
Take sha256("sausage") for instance:
$ echo -n 'sausage' | sha256sum
30caae2fcb7c34ecadfddc45e0a27e9103bd7cfc87730d7818cc096b1266a683  -

Load up bitaddress and paste that private key into the 'wallet details' tab to get the corresponding Bitcoin address, then look it up on blockexplorer:
$ GET http://blockexplorer.com/q/getreceivedbyaddress/1TnnhMEgic5g4ttrCQyDopwqTs4hheuNZ; echo
0.01000000

and you'll see that the address held one bitcent for about 2 days in February 2012.
See also: "fuckyou", which held 2.5 bitcents for 12 festive days at the turn of last year.
So in practice it's possible to brute force bitcoin address creation, but only for poorly chosen passphrases.  These were probably just people playing around with the idea of "storing bitcoins in their head" which is why they are for such small amounts, and why they weren't left funded for long.
No address balances were harmed in the making of this answer.

5: <p>Bitcoin users frequently generate new addresses for each transaction they make, which greatly increases the number of bitcoin addresses being used to receive money.</p>

<p>Would it be possible (and profitable) for someone to find collisions in the bitcoin address space in order to steal money?</p>
 56: <p>Possible: Yes.</p>

<p>Probable: No.</p>

<p>Many events are possible even though they're not probable. The likelihood of bruteforcing a bitcoin private key is improbable enough that with current computing standards it is, for all intents and purposes, impossible.</p>

<p>As the science of cryptography develops and as bruteforcing becomes more powerful the underlying bitcoin infrastructure will be improved to keep pace with the improving technology. This may require accessing your bitcoin wallet using an improved client in the future to maintain a high standard of security.</p>

<p>Additionally, a bitcoin address is not the same as a private key. Generating a bitcoin address will allow an attacker to send you coins, but it would not allow them to sign transactions with your private key (i.e. remove coins from your wallet).</p>
 14: <p>Theoretically it is possible (but not profitable).  But in reality the amount of money you would have to spend to do it would be a lot more than what you would make.</p>
 13336: <p>If you prefer diagrams: <a href="https://i.imgur.com/ag3KQ0L.png" rel="nofollow noreferrer">http://i.imgur.com/ag3KQ0L.png</a> (there are more addresses in the address space than there are zeptometres, 1/1 000 000 000 000 000 000 of a metre, in the universe's width).</p>

<p>If you prefer maths: <a href="http://download.wpsoftware.net/bitcoin-birthday.pdf" rel="nofollow noreferrer">http://download.wpsoftware.net/bitcoin-birthday.pdf</a> (by <a href="http://www.wpsoftware.net/andrew/" rel="nofollow noreferrer">Andrew Poelstra</a>) says (slightly edited):</p>

<blockquote>
  <p>Using [birthday attack maths], we calculated [above] that for a 0.1% probability of collision, we would need 5.4 × 10^22 addresses in existence. For a 99.9999% chance, we would need 6.35 × 10^24 addresses.</p>
  
  <p>So, even if there were 10^22 bitcoin addresses generated, a collision simply will not happen.  But if there were 10^25 addresses generated, a collision absolutely would happen.</p>
  
  <p>Should we worry about this?  No, for these independent reasons:</p>
  
  <ol>
  <li><p>The chance of getting a specific collision, say, a collision with one of your addresses, is still 1 in 2^160 or 1 in 10^48 . So even if you've got a million million million addresses, nobody has a chance of colliding with you.</p></li>
  <li><p>At the time of this writing, there are less than 10^7 addresses in use in the network.  So anyone with 10^25 addresses would only be colliding their own addresses.</p></li>
  <li><p>Each address takes around 100 bytes to store. (Actually about half that, but we only care about orders of magnitude.) So for the network to support 10^25 addresses, it would take 10 million million terabytes of storage just to record them.  (And this is not even touching the problem of <em>searching</em> such a huge data store.</p></li>
  <li><p>According to sipa, if the current mining network (which is at 25 THash, and the most powerful computing network in the history of the world) were switched over to address generation, the network could generate 2.5 × 10^12 addresses per second (one address generation corresponding to roughly 10 hashes). At that rate, it would take 127,000 years to get so many addresses. It is debatable whether homo sapiens has walked the earth for that long.</p></li>
  <li><p>With 21 million bitcoins ever existing, and 8 decimal places of divisibility, at most 2.1 × 10^14 can possibly have money on them at once.  But in a space of 10^24 addresses, this means that only one in 10^12 addresses could possibly have money on them. So an attacker, after doing the physically impossible 3 trillion times over, has only a one in a trillion chance of getting even one satoshi out of it.</p></li>
  </ol>
</blockquote>
 64340: <p>There is the <a href="https://lbc.cryptoguru.org/about" rel="noreferrer">LBC</a> (Large Bitcoin Collider) project that attempts to do that. According to their website they've created over 8,000 trillion keys, as of October 2017.</p>

<p>According to a Motherboard <a href="https://motherboard.vice.com/en_us/article/nzpv8m/the-large-bitcoin-collider-is-generating-trillions-of-keys-and-breaking-into-wallets" rel="noreferrer">article</a> of April 2017, LBC found over 30 Bitcoin private keys. </p>
 30076: <p>If you would like to see some proof to verify that it is truly quite impossible to generate a known keypair, you could test this yourself, if you wanted.</p>

<p><a href="https://github.com/prusnak" rel="noreferrer">Pavol Rusnak</a> has created coinkit, a python library for interacting with Bitcoin related stuff. In there, there is an <a href="https://github.com/prusnak/coinkit/blob/master/vagabond" rel="noreferrer">example on how to use it</a> that does exactly what you are asking.</p>

<p>What it does is it generates a random keypair and searches blockchain.info for a balance.</p>

<p>I let it run about a month ago with slight modifications on about 1mio adresses and did not find a single one colliding.</p>
 53: <p>No, it is not possible, for two reasons.</p>

<p>First, you would have to generate and hash an unimaginably large number of ECDSA keypairs to have a reasonable chance of finding a collision. With current computing power, that would take longer than the age of the universe.</p>

<p>Second, as pointed out in the other answers it is much more profitable to generate bitcoins if you have lots of computing power.</p>
 1083: <p>In order to spend money sent to a Bitcoin address, you just need to find a ECDSA public key that hashes to the same 160-bit value. That will take, on average, 2<sup>160</sup> key generations.</p>

<p>Supposing you could generate a billion (2<sup>30</sup>) per second, you need 2<sup>130</sup> seconds.</p>

<p>Doing this in parallel using a billion machines requires only 2<sup>100</sup> seconds.</p>

<p>Getting a billion of your richest friends to join you gets it down to only 2<sup>70</sup> seconds.</p>

<p>There are about 2<sup>25</sup> seconds per year, so you need 2<sup>45</sup> years.</p>

<p>The age of the Universe is about 2<sup>34</sup> years so far — better get cracking!</p>
 22: <p>It may be "theoretically" possible, but in reality it's unlikely to be achieved - As in counting the number of atoms in an office building unlikely.</p>

<p>Bitcoin addresses are actually the 256-bit <a href="http://en.wikipedia.org/wiki/SHA-2">SHA</a> hash of an <a href="http://en.wikipedia.org/wiki/Elliptic_Curve_DSA">ECDSA</a> public key, so any vulnerabilities in those algorithms would constitute a vulnerability in bitcoin itself. Realistically, however, breaking this level of encryption requires a huge amount of processing power. Coincidentally it requires precisely the same kind of processing power that bitcoin mining requires and in almost every scenario it would be massively more profitable to mine than to hack.</p>

<p><em>Edit: It's actually RIPEMD-160(SHA-256(public key)) as opposed to just SHA-256(public key) as I originally mentioned, so it's a 160-bit hash of a 256-bit hash of a public key. While the target keyspace (160 bits) is smaller thanks to this final step, it's also an additional computation that a would-be hacker must make. While the additional computational complexity doesn't even come close to canceling out the removal of 96 bits of keyspace, it should be noted that finding a collision in a 160-bit keyspace is still incredibly difficult and time consuming. More importantly, it is more difficult and time consuming than actually mining the same number of coins would be, thus making it highly unlikely anyone would even attempt such an attack - even if the equipment to make such an attack plausible in a meaningfully small span of time existed.</em></p>
 659: <p>It is possible to brute force some Bitcoin addresses, because some people generate their private keys in an insecure manner.  Any (non-zero) 32 bytes can be a private key.  So running sha256 over a passphrase gives an apparently random, but brute force-able private key.</p>

<p>Take sha256("sausage") for instance:</p>

<pre><code>$ echo -n 'sausage' | sha256sum
30caae2fcb7c34ecadfddc45e0a27e9103bd7cfc87730d7818cc096b1266a683  -
</code></pre>

<p>Load up <a href="https://www.bitaddress.org/">bitaddress</a> and paste that private key into the 'wallet details' tab to get the corresponding Bitcoin address, then look it up on <a href="http://blockexplorer.com/address/1TnnhMEgic5g4ttrCQyDopwqTs4hheuNZ">blockexplorer</a>:</p>

<pre><code>$ GET http://blockexplorer.com/q/getreceivedbyaddress/1TnnhMEgic5g4ttrCQyDopwqTs4hheuNZ; echo
0.01000000
</code></pre>

<p>and you'll see that the address held one bitcent for about 2 days in February 2012.</p>

<p>See also: "fuckyou", which <a href="http://blockexplorer.com/address/1LdgTMX2MEqdfT3VcDpX4GyD1mqCP8LkYe">held 2.5 bitcents</a> for 12 festive days at the turn of last year.</p>

<p>So in practice it's possible to brute force bitcoin address creation, but only for poorly chosen passphrases.  These were probably just people playing around with the idea of "storing bitcoins in their head" which is why they are for such small amounts, and why they weren't left funded for long.</p>

<p>No address balances were harmed in the making of this answer.</p>
