Silent payments (BIP352) use elliptic curve cryptography to derive unlinkable Bitcoin addresses from a static public key. However, they are vulnerable to a harvest-now-decrypt-later (HNDL) deanonymization attack: if ECDLP is ever broken by a cryptographically-relevant quantum computer, any attacker who stored a silent payment address today could retroactively link all transactions associated with it. Unlike BIP32 HD wallets where xpubs are discouraged from public posting, silent payment addresses are designed to be shared publicly, making them more exposed to this future risk. The attack is limited to cases where the SP address was stored by an attacker, so privately shared addresses are less at risk. Users are advised to treat their SP address with the same caution as a BIP32 xpub.
