Although there are tools for that, we are limited by the fact that you would have to know the public key of your target addresses. I have 250,000 pulic keys of the richest addresses, updated every month, but the problem is i would have to be searching for those in the 253-256 bit to ever dream of finding the private key. Since this is almost ALMOST impossible to achieve, pub key cracking should only be used on puzzle addresses and even those are in the high bit range i.e 125-160 bits . That's why i was originally was talking about searching through pure private key cracking. Which gets me to the previous point of hash160 prefix. You're right, prefixing h160 would break the function. Looks like we're gonna stick to conventional ways.