Harvest Now, Decrypt Later: Why Timing Matters
This is the single most misunderstood point in the quantum-and-crypto conversation, and it is worth isolating from the rest.
No quantum computer today can break the cryptography behind a typical crypto wallet. That fact is often used to argue there is no urgency. It misses a separate, already-real risk: recording data now and decrypting it later.
Anyone can capture encrypted traffic or exposed public keys moving across a network today, store the raw bytes cheaply, and simply wait. If a capable enough quantum computer exists in five years, or fifteen, that stored data can be decrypted at that later date -- using the key material exposed years earlier, not anything captured at the moment of decryption.
That reframes the actual question. It is not “when will quantum computers arrive,” which no one can answer with confidence -- estimates from serious researchers vary widely and have moved in both directions as the field progresses. The real question is “when is my key material exposed,” because that is the moment the clock actually starts, and it may already have happened for data moving today.
This is the specific reasoning behind protecting keys with post-quantum cryptography now, while the cost of doing so is low, rather than waiting for a firm date that may never arrive with advance notice. It is also the reason BMIC built its wallet on NIST-standardized post-quantum cryptography (CRYSTALS-Kyber, ML-KEM) from the start, rather than treating it as a later upgrade.
FAQ
Does harvest-now-decrypt-later mean my funds are at risk today?
It is a risk to data exposed today that could be decrypted in the future, not a claim that current transactions can be broken right now.
Who would actually do this kind of harvesting?
Any well-resourced actor with an incentive to hold data long-term -- this is a documented concern in cryptographic research generally, not a claim specific to any one attacker.
Does using post-quantum cryptography today fully remove this risk?
It removes the specific mechanism described here for data protected going forward. It cannot retroactively protect data that was already exposed under older cryptography before the switch.
Why not just wait until quantum computers are closer to ready?
Because the exposure that matters happens at the moment data is captured, which can be years before any decryption -- waiting for certainty on the arrival date means accepting that earlier exposure window.