ECDSA secp256k1 attacks
Yes.  Pollard's $\rho$, a generic method to compute discrete logs, costs only about $2^{128}$ group operations for a group of order about $2^{256}$ so secp256k1 should be considered to have a ‘128-bit security level’, not a ‘256-bit security level’, against discrete logs.  But a 128-bit security level is enough to thwart all adversaries—at least, the ones who don't have a quantum computer or a cryptanalytic breakthrough against secp256k1 in particular.