TL;DR
Let's try to estimate this, based on some purported data [if someone has better data they can make the estimate better as well].
There is a claim I read somewhere, that I can't find a link to, that there were 200 quintillion SHA256 hashes computed in Bitcoin mining per second, sometime in the recent past.
If this is reasonable, then the minimum is about $2^{159}$ which is a 256 bit number with 97 leading zeroes.
Details:
If you have data about how many in other applications, in case this is not negligible compared to Bitcoin computations, you can adjust.
We model the SHA256 output as being uniformly distributed on
$$
\{0,1,\ldots,M-1\}
$$
where $M=2^{256}.$ Assuming independence, if you have $n$ SHA outputs $X_1,\ldots,X_n$ then the minimum
$$Y=\min\{X_k:1\leq k\leq n\}$$
satisfies
$$
\textrm{Prob}\{Y > y\}=\left(\frac{M-y}{M}\right)^n.
$$
This means that if you want this probability to be say $2^{-k},$ then it can be computed by plugging in $M$ but you'll need to take logs and be careful.
If you're lazy and only want the expected minimum, you can find the CDF ${Prob}\{Y \leq y\},$ differentiate to get the density, and compute the expectation. See this question where this is detailed. If the distribution of the $X_i$ and $Y$ is projected on to the interval $[0,1)$ by dividing the hash output by $2^{256},$ and treating it as a real valued random variable, then the expectation is simply $\frac{1}{n+1},$ which is pleasing. Lifting back to $\{0,\ldots,M-1\}$ gives an expectation of the minimum being
$$
\frac{M}{n+1}.
$$
For 300 quintillion hashes per second (check my computations) I get
a hashrate of $2^{67}$ per second or $2^{92}$ per year. So using a year, we get the expected minimum $Y$ to be approximately
$$
\frac{2^{256}}{2^{97}}=2^{159},
$$
with 97 leading zeroes in its binary expansion.
