What the Harvest Now, Decrypt Later Attack Is
A harvest-now-decrypt-later (HNDL) attack has two phases separated by years or decades. In the first phase, an adversary records and stores encrypted communications or signed transactions. In the second phase, once quantum hardware capable of breaking the underlying cryptography is available, the adversary decrypts the stored data.
This is not a hypothetical. Intelligence agencies are known to store intercepted encrypted communications for later decryption. The operational assumption is that data which is sensitive today will still be sensitive in ten years, and that quantum computing will be available before the data's value expires.
For blockchain networks, the attack model is somewhat different because most blockchain data is already public. The relevant attack is not decrypting stored ciphertext but deriving private keys from publicly recorded public keys, then constructing forged transactions to drain wallets or alter signing authority on long-lived contracts.
Why October 2026 Changed the Urgency Calculation
Two events in October 2026 materially shortened the timeline between "today's data" and "when it can be compromised."
Alice & Bob's Revised Qubit Estimate
The previously dominant estimate for breaking Bitcoin's secp256k1 was 317 million physical qubits, which suggested a timeline measured in decades. Alice & Bob's October 2026 analysis revised this to approximately 29,588 physical qubits using modern error correction techniques and the no-time-constraint attack model against already-exposed public keys. This is a reduction of over 99.9 percent.
At 29,588 physical qubits, the required hardware is potentially within reach of current IBM and Google roadmaps on a 5-to-10 year horizon. The HNDL threat window is therefore not "decades away" but "within the plausible lifetime of decisions made today."
IBM's Modular Coupler Demonstration
IBM's October 27 demonstration of meter-scale superconducting couplers with 99% state transfer fidelity showed that the modular scaling path to tens of thousands of qubits is now tractable. Distributing 29,588 qubits across 25 processors of 1,200 qubits each, connected by inter-chip couplers, is an engineering project, not a physics breakthrough.
What Data Is Being Harvested Right Now
Any public key that has been recorded on a blockchain is permanently available for quantum attack once capable hardware exists. This includes:
- All Bitcoin P2PK outputs: Early Bitcoin transactions paid directly to public keys. These represent millions of BTC, including coins in addresses associated with Satoshi Nakamoto.
- All Bitcoin P2PKH addresses that have ever spent: Once a P2PKH address signs a transaction, its public key appears in the transaction input. This is true for the majority of all Bitcoin transactions ever made.
- All Ethereum EOA accounts that have ever sent a transaction: The public key of every externally owned Ethereum account is on-chain the moment it first sends a transaction.
- Smart contract operator keys: Multi-sig wallets, DAO governance keys, oracle operator addresses — any key that has signed an on-chain operation has its public key permanently recorded.
- Cross-chain bridge validator keys: Bridge operators routinely sign transactions on multiple chains. Every signature reveals the signing key.
The total value exposed runs into the hundreds of billions of dollars across major blockchain networks. None of this data needs to be "harvested" by an adversary — it is already public on distributed ledgers readable by anyone.
What "Decrypt Later" Means for Different Time Horizons
Consider a blockchain transaction signed today with ECDSA secp256k1. The signing key's public key is now permanently recorded. The question is: at what point does a quantum adversary have sufficient hardware to derive the private key from that public key?
Using the revised estimates:
- If physical qubit quality reaches 10^-4 error rate at 29,588 qubits: The attack becomes technically possible. IBM's roadmap suggests this could occur between 2029 and 2033, depending on inter-chip fidelity milestones.
- If PsiQuantum's CMOS-manufactured photonic system reaches fault-tolerant operation: The timeline could be 2030-2035, but the manufacturing scalability could enable faster ramp-up once the threshold is crossed.
- If national quantum programs in the US, China, France, and others accelerate timelines: State-level adversaries may have access to fault-tolerant quantum hardware 3-5 years before commercial systems are available to the public.
A transaction signed today could be compromised between 3 and 12 years from now. For most financial instruments, that is within the asset's useful life.
The Cost Asymmetry
Migrating to post-quantum signatures now has a known, bounded cost. For a blockchain developer, the cost is implementing ML-DSA or SLH-DSA key generation, signing, and verification in place of ECDSA. For an asset holder, the cost is a transaction fee to move funds to an address whose key has not been exposed.
The cost of not migrating is unbounded. If a quantum adversary drains wallets with exposed keys, the funds are irreversibly transferred. There is no mechanism in current blockchain architectures to reverse or recover from a quantum key compromise.
This asymmetry — bounded migration cost versus unbounded compromise risk — is the core argument for acting now rather than waiting for quantum hardware to become commercially available.
What Post-Quantum Migration Looks Like in Practice
For blockchain protocols, post-quantum migration involves replacing ECDSA at the signature layer with algorithms from the NIST PQC standard suite. The primary candidates are:
- ML-DSA (CRYSTALS-Dilithium, FIPS 204): Lattice-based digital signature. Signature sizes of 2,420 to 4,595 bytes depending on security level, versus 64 bytes for ECDSA.
- SLH-DSA (SPHINCS+, FIPS 205): Hash-based digital signature. Larger signatures (7,856 to 49,856 bytes) but based on the security of well-studied hash functions rather than lattice assumptions.
- FN-DSA (FALCON, FIPS 206): Lattice-based with smaller signatures than Dilithium (~666 bytes) but more complex constant-time implementation requirements.
The signature size increase imposes a throughput cost that must be addressed at the protocol level, which is why blockchains like QuanChain that use multi-channel architectures and data compression are better positioned for post-quantum operation than monolithic chains that attempt a direct swap.
The right time to address this is before the HNDL window closes — which, based on October 2026 data, is materially closer than it appeared a year ago.
