Crypto faces a close cousin of this problem, and in a way, it's worse. The attacker's starting material, the public key, is usually sitting out on an open ledger. That key is meant to be public. The risk is what a large enough quantum computer could do with it: derive the matching private key and forge a valid signature.
Nothing gets decrypted in crypto’s case, which is why the closer description here would be ‘exposed now, forge later.’ Nobody even has to record anything, because the ledger keeps the key on display by design.
For encrypted data the attacker has to collect first. For a public key, that step is already done.
What the phrase means
The idea comes from encrypted communications. For decades, intelligence agencies have recorded traffic they couldn't yet read, betting they'd break it eventually. The declassified NSA VENONA project is the textbook case: U.S. codebreakers collected encrypted Soviet cables through the 1940s and read many of them over the years that followed, before the effort wound down in 1980. The translations stayed secret until public releases began in 1995. That break came from Soviet reuse of one-time pads instead of faster computers, but the shape is the same: record now, read later.
The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the National Institute of Standards and Technology (NIST) named the risk directly in their 2023 quantum-readiness factsheet. In it, they warned that threat actors "could be targeting data today" that has a long secrecy lifetime, through a "catch now, break later or harvest now, decrypt later operation." The math behind the worry is Shor's algorithm, which breaks RSA and elliptic-curve cryptography once a big enough machine exists.
What makes the strategy work is a mismatch between three clocks: how long your data has to stay secret, how long it takes to migrate to quantum-safe cryptography, and how long until a machine can break the old schemes. If your data’s secrecy window plus your migration time runs longer than the time left until a capable machine exists, then data you send today is exposed, as that machine can reach back to it once it arrives.
The logic holds without a quantum computer in the room right now. It only needs one to exist eventually.
Secrecy lifetime plus migration time, measured against the countdown to Q-Day.
Why the crypto version is different
For encrypted email or a VPN session, an attacker has to do the collecting. The ciphertext has to be captured while it's moving, or pulled from a server or backup that stored it, then held against a payoff that may never come.
A blockchain removes the collection step. Public keys and signatures live on the ledger by design, permanent and public from the moment they appear. An attacker doesn't have to capture anything now or even copy it early, because the same records will still be there after a quantum computer appears. The target list builds itself.
A revealed public key can't be hidden again either. Once it's on-chain, it's there forever, and no upgrade can undo that. Still, you can change how much that key guards. Move the coins to a fresh key and the old one will no longer control anything worth stealing, despite staying exposed. Leave them, and the key stays a live target for as long as the coins sit behind it. Which address types expose a key and which keep it hidden is its own topic you can read about in our Is Bitcoin Quantum Safe? guide.
The exposure that already exists
Because the ledger is public, an attacker has nothing left to collect. The keys they would target are out in the open, and they'll still be visible whenever the machine that can use them arrives.
The exposed pile is large. On Bitcoin, Project Eleven's Bitcoin Risq List puts about 7 million BTC behind exposed public keys in 2026. An older Deloitte analysis found more than 4 million using a narrower classification, so the two aren't a clean before-and-after; the methods and the dates behind them differ. Either way, much of the exposure traces back to the earliest coins, whose pay-to-public-key outputs wrote the full key straight into the script.
Across the market, qLABS' Quantum-Vulnerable Capital research puts the exposed footprint near $2.52 trillion, combining around $2.25 trillion in top-20 Layer 1 market value with about $268 billion in stablecoin float. This figure tracks how much value rides on chains that haven't migrated yet and not how many coins are proven to sit behind exposed keys. Also, none of it is being stolen today, but for the slice that does sit behind exposed keys, the attack input is already public.
A disclosure belongs here, since we’re citing our own research. qLABS produced this article, built the index behind that figure, and operates qVAULT. qONE is qLABS' own token and one of the vault's supported assets, so the company has a direct commercial interest in this market.
One clock already stopped
For an exposed key, the first of those three clocks sits at zero. A public key was never hidden from view, so there's no secrecy left to run down and nothing for an attacker to collect. What remains is a race between migration and the arrival of a machine capable of deriving the private key fast enough to use it.
This reframes what Q-Day means for a crypto holder. Your deadline is to move exposed coins onto a quantum-safe scheme before such a machine can attack them, where the timing is uncertain. Expert surveys give it as a probability with no fixed date, and we track those forecasts in What Is Q-Day?. The qubit counts required for the attack have been decreasing fast, though a smaller number on paper isn't the same as an earlier arrival. The exposure itself doesn't move.
What still reduces your exposure
The hard part of an exposed key is that it can't be made secret again. If a quantum computer derives the private key before you move the coins, or before the protocol changes its spending rules, those coins are open. So the defenses that count are the ones you put in place ahead of that moment.
Don't reuse addresses, and keep long-term funds in address types that hide the public key behind a hash until you spend from them, like P2PKH or P2WPKH. Taproot doesn't help here, since it puts the key on-chain from the start, as the 2026 Google-led analysis notes. This doesn't make the coins quantum safe, but it keeps them off the target list until the day they move.
Those steps buy time. The durable fix is protocol-level migration to post-quantum signatures. NIST finalized its first post-quantum standards in August 2024, covering the ML-KEM key-encapsulation mechanism and the ML-DSA and SLH-DSA signature schemes. The Falcon-based FN-DSA signature is undergoing NIST standardization, not yet final as of mid-2026.
On smart-contract chains, there's a second lever. An asset can be placed behind a post-quantum authorization step now, so that a broken ECDSA key on its own can't move it. This is the model qLABS built qVAULT around: a non-custodial vault that adds a Falcon-based withdrawal condition on top of a standard wallet.
It currently supports qONE and HYPE on HyperEVM, with Ethereum and stablecoins planned. But because it's smart contract-based, qVAULT can never cover native Bitcoin. It protects a contract-level authorization path, not the underlying chain, and carries the usual contract risk.
qVAULT is one effort among several. Cardano has post-quantum research underway, and Ethereum is working on accounts that could adopt new signature schemes.
Please note that none of the above is financial advice.
Reading the threat
‘Harvest now, decrypt later’ does its collecting today and pays the attacker off years later. Crypto's version is even more passive: for affected addresses, the public keys are exposed from the outset, so there’s no ‘harvesting’ to do.
The open question is when a machine will be able to derive their private keys fast enough to exploit them. Some resource estimates have decreased over the past year, but the arrival date remains a forecast as opposed to a countdown.
What you can do is find which of your coins sit behind an exposed public key, and move them to an authorization the old key no longer controls before a capable machine exists. You can find out where Bitcoin and the major chains sit on that exposure in the L1 Quantum Vulnerability Index.
FAQ
What does harvest now, decrypt later mean?
It's a strategy where an adversary records encrypted data today and stores it to decrypt later, once a quantum computer can break the encryption protecting it. The data only needs to stay valuable until that machine exists. CISA, the NSA, and NIST flagged it as a pressing reason to start migrating to post-quantum cryptography now, well ahead of Q-Day.
Why is crypto affected?
Public blockchains record signatures and, depending on the chain and address type, they expose the public key either directly or once an account first spends, so there's nothing to intercept. Once a quantum computer can run Shor's algorithm at scale, it could derive the private key from an exposed public key and forge a spend. Nothing gets decrypted, which is why the crypto version is better called ‘exposed now, forge later.’
Is my crypto being harvested right now?
There's no separate harvesting step for on-chain keys. If your public key has appeared on-chain, it's already visible, and it will stay visible. About 7 million BTC sit behind exposed keys on Bitcoin, and qLABS puts the exposed economic footprint across the top chains near $2.52 trillion by market value. No quantum computer can act on any of it yet, but wherever a public key has been exposed, the input for a long-range attack is already available.
Can I undo the exposure?
You can't un-reveal a public key that's already on-chain. What you can do is move the coins to a new address whose public key hasn’t been revealed on-chain, so the old exposed key is left guarding an empty balance. Long-term, the fix is migrating to a post-quantum signature scheme.
When is Q-Day?
Forecasts are probabilities, not dates. The latest Global Risk Institute survey put the chance of a cryptographically relevant quantum computer within ten years at 28% to 49%, rising to 51% to 70% within fifteen. In crypto, nobody needs an exact Q-Day date to justify preparing now. Exposed public keys stay available whenever that day comes, so migration has to finish beforehand.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
