Birthday bound
How much data a block cipher can safely process under one key before block collisions start leaking information — roughly 2n/2 blocks for an n-bit block.
The ceiling is set by block size, not key length. In CBC, two identical ciphertext blocks eventually become inevitable, and when they appear they reveal the XOR of two plaintext blocks. CTR has the opposite problem: its blocks never repeat, which is itself a tell that the stream isn't random. With 64-bit blocks — DES, 3DES, Blowfish — the bound sits around 232 blocks, or about 32 GB.
For years this was a textbook footnote, because nobody pushed that much data through a single key. Then came long-lived HTTPS connections and Sweet32 in 2016, which recovered cookies from 3DES traffic using exactly this arithmetic. AES's 128-bit blocks push the bound to 264, though modes like AES-GCM still impose their own, much stingier limits when nonces are random.