This partial collision was computed in 10 minutes on a mid-range desktop GPU. There is no weakness in sha256 being exploited, just an application of the Birthday Paradox.

I used the methodology from this paper https://www.cs.csi.cuny.edu/~zhangx/papers/P_2018_LISAT_Weber_Zhang.pdf "Parallel Hash Collision Search by Rho Method with Distinguished Points" - but with a single GPU instead of a university HPC cluster!

By the way, the attack complexity would be the same no matter how long the prefix is. Furthermore, there could be two different prefixes (i.e. "good" vs "evil"), although the attack would get about 50% more expensive on average.

@wolf480pl even if the prefix is 256GB long