Harvest Now, Decrypt Later: How It Affects Crypto Specifically

Harvest now, decrypt later (HNDL) is a class of attack where adversaries capture encrypted data today and store it for decryption once quantum computers powerful enough to break current cryptography exist. The technique threatens any data with long-term confidentiality requirements. For cryptocurrencies, the threat takes shapes that don’t apply to most other industries.

What Is Harvest Now, Decrypt Later?

The strategy is simple in concept. Capture ciphertext now. Decrypt it when the math becomes breakable. For most systems secured by RSA, Diffie-Hellman, elliptic-curve Diffie-Hellman, ECDSA, or ElGamal, that day arrives once a fault-tolerant quantum computer can run Shor’s algorithm at scale. Estimates of when that happens range from the early 2030s to never. Cryptographers tend to settle somewhere uncomfortable in the middle.

The 2013 Snowden documents described NSA programs like Bullrun that targeted encrypted communications at scale, including traffic considered unreadable at the time of capture. Anyone assuming nation-state actors have stopped that practice is being charitable. And commercial actors with patience and storage budgets can do the same.

Any information that needs to stay private for decades is already in HNDL territory.

Why Crypto Faces a Sharper Version of the Problem

HNDL coverage usually focuses on encrypted communications like email and TLS-protected web traffic. Crypto inherits all of that, plus something most other industries don’t have to worry about. A lot of cryptocurrency data is already public on a blockchain.

Blockchains don’t require an attacker to “harvest” anything. The data is published the moment a transaction is broadcast. The collection step solved itself a decade ago. What remains is the decryption step, which for Bitcoin and most other major chains depends on Shor breaking ECDSA.

What Blockchain Data Is at Risk Under HNDL

The biggest exposure in cryptocurrency is the public key. On Bitcoin, addresses are hashes of public keys. That gives you a buffer until the first spend. Spend from an address and the public key is revealed in the transaction. That public key is now sitting on the chain, available for any future quantum-equipped attacker who finds the time to derive the private key from it.

Coins held in unspent P2PKH or P2WPKH outputs still hide their public key behind a hash. That gives them better cover. Coins on reused addresses lose the protection on first spend, and legacy P2PK outputs never had any cover to begin with, because P2PK puts the public key directly in the script. A 2020 Deloitte analysis estimated that around 25% of all Bitcoin sits in addresses with revealed public keys. A large share is Satoshi’s original P2PK mining rewards. The rest comes from address reuse and other legacy outputs.

Ethereum is in the same boat. Ethereum addresses are Keccak-256 hashes of public keys, but the moment an account signs a transaction, the public key can be recovered from the signature. Deloitte’s Ethereum analysis estimated that more than 65% of all ether sits in addresses with exposed public keys.

Privacy-focused chains like Monero and Zcash see HNDL in a different shape. The cryptography that hides transaction graphs depends on assumptions that quantum computers also undermine. A privacy chain that uses elliptic curve cryptography for ring signatures or zk-SNARKs could face retroactive de-anonymization or weakened privacy guarantees once Shor becomes practical. Transactions that look private today may become traceable in a post-quantum world.

What Off-Chain Crypto Data Is at Risk

Crypto businesses sit on encrypted databases of order books, KYC documents, user authentication credentials, and audit logs that go back years. If any of that gets captured today (through a database breach or a nation-state collection program), HNDL puts it on the clock.

Hardware wallet vendors face a related problem. Firmware signing keys protect the chain of trust between the vendor and the user’s device. If those keys can be derived after the fact from intercepted firmware traffic, the door opens to retroactive supply-chain attacks against a hardware wallet population that’s already been shipped and trusted.

KYC data tops the off-chain risk list. Exchanges hold government IDs, residential addresses, bank statements, and selfies for millions of users. Encrypted backups exist on cloud providers and offline tape archives. Anything captured today becomes a future privacy and identity-theft incident the moment quantum decryption matures.

When Does HNDL Actually Pay Off for Attackers

For HNDL to be worth the storage cost, two conditions need to hold. The math the attacker is betting against must break within the data’s useful lifetime. The decrypted data must still have value when the math breaks.

Most encrypted internet traffic doesn’t survive that test. A web session encrypted with TLS today contains data with a short shelf life. But few attackers would bother decrypting a 2024 email about lunch plans in 2040.

Crypto changes the calculation. A 2024 KYC document still identifies the same person in 2040. Trading patterns leaked from exchange databases and on-chain spending history are the same story. And both have lasting value to attackers in ways email traffic never does.

The attacker’s economics also work better for centralized targets. Crack one exchange database after Q-Day and you get millions of identities. Crack one user’s wallet and you get one wallet. Centralized crypto infrastructure offers high-value bulk targets that an HNDL strategy is built to exploit.

What Crypto Users and Projects Can Do About It

For individual crypto users, the practical hygiene is short. Don’t reuse Bitcoin addresses, and hold coins you plan to keep for years in P2WPKH outputs, which keep the public key hashed until spend. Avoid legacy P2PK and Taproot for that purpose, because both put the public key directly on chain. Beyond that, be aware that any KYC information you’ve ever submitted to an exchange is in the potential HNDL pile, and that there’s no way to “recall” it.

Exchanges and custodians have a harder job. They need to adopt NIST’s post-quantum cryptography standards, re-encrypt legacy backup archives, audit historical data for what would happen if it surfaced after Q-Day, and pressure hardware vendors to ship post-quantum firmware signing.

NIST finalized the first batch of those standards in August 2024. The set covers key encapsulation under ML-KEM and digital signatures under ML-DSA and SLH-DSA.

At the protocol level, the harder migration is more political than technical. What to do about coins that have already revealed their public keys is a question without a comfortable answer. A consensus burn of those coins would be politically explosive. Inaction would create a quantum-era bounty for whoever can claim them first. The Bitcoin community hasn’t started this conversation in earnest yet. That silence costs time.

HNDL pays off slowly and quietly. The capture happens without your knowledge, and the decryption happens years later. The window to act is now. Almost everyone will spend it on other things.