Qubic Lost 1,404 Wallets to Math.random. SlowMist Rebuilt a Private Key From 6 Header Values

What Happened

Qubic said on Sunday, October 18, that an attacker had drained about 2.94 trillion QU, about $1.3 million at the time by most counts and $1.4 million by Cointelegraph's, from 1,404 wallets between 23:42 UTC on Saturday and 01:26 UTC on Sunday, and its validators, which the network calls Computors, stopped the chain at tick 85,371,949.

'Some wallet seeds were generated with insufficient randomness, making them weaker than they should be,' the project wrote on X, as quoted by Cointelegraph and CryptoPotato. 'The issue was in seed generation, not in the Qubic protocol itself.' The halt is why 87.1% of the stolen QU never moved again.

The 12.9% that reached the exchange MEXC was frozen in the receiving account within an hour, per Crypto Briefing and Tangem.

The exposed seeds, by Qubic's list, were generated in any browser on an iPhone or iPad, or in Safari on a Mac, before October 18, or in the Qubic iOS app before July 2025. The cause is in the wallet's own repository. The commit that fixed it, released on GitHub on October 18 as version 4.

26.4 under the title 'use cryptographically secure seed generation', removes a loop that picked each of a seed's 55 letters with Math.random and replaces it with crypto.getRandomValues, the browser's cryptographic generator. The patch changes how new seeds are made and does nothing for old ones.

Per Cointelegraph, the chain resumed past the halt tick on Monday, October 19, after the network's arbitration committee approved a recovery plan, and Qubic said on Tuesday, October 20, that a claims site is open, with filings accepted until May 1, 2027. The project says refunds to verified owners have begun, per KuCoin News; no count of paid claims had been published as of this writing.

A seed is a secret only if nothing else the wallet does is computed from the same state. Qubic's wallet rolled its dice once, kept that result as the key, and sent the next rolls to the network in the clear.

The Same Dice, Rolled in Public

SlowMist, the Chinese security firm, published its analysis on Tuesday. The 55 lowercase letters of a Qubic seed nominally carry about 258 bits of entropy. Math.random, which the web's own documentation marks as unfit for anything security-related, supplied far less: in Crypto Briefing's account of the analysis, an attacker on the affected platforms faced about 2^32 possibilities, a search a laptop finishes.

Qubic has not said why its list is specific to Apple's browsers. The finding that reaches past Qubic is the second one. The same Math.random stream fed a value called dejaVu that the wallet placed, in plaintext, in the header of requests it sent to the network, and in a local test 6 consecutive header values let SlowMist rebuild the generator's state and arrive at the seed and the private key; 4 or 5 values left several candidates.

The firm calls the path hypothetical and does not claim it was the route used on October 17.

The obvious objection is that a web wallet for a small chain is not where careful holders keep value. The record answers it: the first finding alone has been enough, repeatedly, on Bitcoin. Browser Math.random is what made the 2011 to 2015 wallets that Unciphered named Randstorm guessable.

A 32-bit seed to a Mersenne Twister generator emptied wallets from Trust Wallet's browser extension in 2022 and 2023 and from Libbitcoin's bx seed command in 2023. Coldcard was a hardware device built for exactly the careful holder, and a pseudorandom fallback in its firmware cost those holders more than $100 million in bitcoin from July 30 this year, as this site covered.

Qubic is the 3rd weak-seed failure of 2026 reported here, after Coldcard and the CryptoJS flaw behind Ill Bloom, and the first in which the generator's output was also on the wire.

What This Means for You

If you made a Qubic wallet under any of the 3 conditions, treat the seed as public: create a new wallet on 4.26.4 or later, move what remains, file at the claims site before May 1, 2027, and expect the fake reclaim pages that follow every halt; no legitimate process asks for a seed.

For everyone else, 2026 has now supplied the full set of ways a seed goes wrong before you ever hold it: a hardware wallet with a broken fallback, a shared JavaScript library, and a web page on a phone. Entropy cannot be audited after the fact. A 55-letter string from a weak generator looks exactly like one from a strong generator, and so does a 12-word phrase, so the only usable test is provenance: a seed generated on a device built for the job, ideally from dice rolls you supplied, and never on a web page or in an app whose maintainer you cannot name.

Qubic adds one rule the earlier cases did not. SlowMist's header attack works because the wallet computed something visible from the same state as the secret. Key control means nothing you broadcast is a function of the key: not a seed typed into a web page, not a signature whose nonce came from a weak generator (the 2013 Android flaw let a private key be derived from 2 signatures), not identifiers drawn from the generator that made the seed.

The halt cuts the other way. Qubic's Computors could immobilize 87.1% of the loot because they can stop the chain; the Coldcard sweep on Bitcoin was unrecoverable in the same minutes because no one can. A chain that can refund you is a chain that can hold you, as Cronos showed in August, and that is the trade to price before parking value on either side of it.

What to Watch

SlowMist says a full technical report will follow once the recovery plan is settled; whether it confirms the header path or names the attacker's actual method decides how many of the 1,404 seeds were sampled rather than searched. The dejaVu header, by the firm's account, still comes from Math.

random after 4.26.4, which no longer matters for new seeds and still matters for any other wallet that reuses one generator across secrets and traffic. The first published count of paid claims before the Saturday, May 1, 2027 deadline is the test of whether a chain-level freeze returns money or only immobilizes it.

An explanation of why Apple's browsers were the exposed platform is this story's missing paragraph.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.