Can anybody please explain why is the probabilty of finding a desired message for random chaining values equal $2^{-224}$? Can someone explain why does probability is equal $2^{-224}$ in the following piece of paper?
The length of messages blocks in Hamsi is equal 32 and the length of chaining values is equal 256.
The second paragraph of section 2 of the quoted paper tells the domain of the function $\mathcal F:\{0,1\}^{32}\times\{0,1\}^{256}\to\{0,1\}^{256}$.

Under the reasonable assumption that for fixed second input ($h_{i-1}$ in the question's statement), $\mathcal F$ behaves as a random function of the first input ($M_i$ in the question's statement), then for each value of the first input the probability that the output matches a fixed target value ($h^*_i$ in the question's statement) is $p=2^{-256}$. That will be repeated for the $n=2^{32}$ possible first inputs.

One way to conclude is to know that if an event has probability $p$ of occurring at each (independent) experiment, then the expected number of events for $n$ experiments is $n\,p$, and the probability of at least one event is barely below that value $n\,p$ as long as it remains small. Here $p=2^{-256}$, $n=2^{32}$, $n\,p=2^{32-256}=2^{-224}$ (as asserted in the question's statement). That's very small, thus the approximation made is valid.

The more mathematical way: the probability of no match for one first input is $1-p$. The probability of no match after $n$ inputs is $(1-p)^n$. The probability of at least one match after $n$ inputs (as discussed in the question's statement) is $1-(1-p)^n$. Using that $1-(1-p)^n=1-e^{n\log(1-p)}$, that $\log(1-p)=-p+o(p)$ (using little-O notation), that $e^x=1+x+o(x)$, it comes that $1-(1-p)^n=n\,p+o(n\,p)$. Hence $1-(1-p)^n$ is about $n\,p$. The error made with this approximation is always by excess. When $n\,p&lt;0.3$, the relative error is less than $16\%$. For lower values of $n\,p$, that upper bound of the relative error becomes barely above $n\,p/2$.

Other useful data points are that if $n$ is large, then $n\,p=1\implies1-(1-p)^n\gtrapprox1-e^{-1}\gtrapprox63\%$; and $n\,p=2\implies1-(1-p)^n\gtrapprox1-e^{-2}\gtrapprox86\%$ This explains the "high probability" after about $2^{224}$ random values of $h_{i-1}$ in the question's statement.