SlowMist Traces $1.3M Qubic Wallet Breach to Math.random() Seed Flaw

Blockchain security firm SlowMist reported on October 20, 2026, that an October 18 breach of 1,404 Qubic wallets—which drained approximately 2.94T QU valued at around $1.3M—stemmed from the web wallet using JavaScript's Math.random() function to create private key seeds. While the 55-character lowercase seed format offered a theoretical space of 26^55, the weak pseudo-random number generator state collapsed the effective brute-force space to about 2^32 possibilities, and outputs from the same random stream were exposed in plaintext via a protocol request header field named dejaVu. According to SlowMist, an observer capturing network traffic could reconstruct the generator state and potentially recover private keys from as few as six observations, with higher risk concentrated in weak-entropy environments including Safari on Mac prior to October 18, 2026, the Qubic iOS app prior to July 2025, and iOS and iPadOS devices more broadly. Following the October 18 incident, Qubic halted its network at tick 85,371,949, allowing validators to freeze about 87.1% of the drained funds on-chain while the MEXC exchange froze the remaining 12.9%. Qubic released web wallet version 4.26.4 on October 18 to replace Math.random() with crypto.getRandomValues() for new seeds, though existing seeds generated in vulnerable environments remain exposed because a software patch cannot retroactively strengthen previously created keys.