Breaches and incidentsBriefConfirmed by two or more outlets
Qubic: web wallet seeds generated with Math.random(), 1,404 wallets drained
23:42 UTC 17 Oct to 01:26 UTC 18 Oct 2026: about 2.94 trillion QU (about USD 1.3M to 1.4M) drained from 1,404 wallets.
- Disclosed
What happened
- 23:42 UTC 17 Oct to 01:26 UTC 18 Oct 2026: about 2.94 trillion QU (about USD 1.3M to 1.4M) drained from 1,404 wallets. Computors halted the network at tick 85,371,949.
- Root cause per SlowMist’s post-mortem: the web wallet generated each 55-letter seed with JavaScript Math.random() and mixed in no other entropy. Values exposed in network headers let the V8 xorshift128+ state be reconstructed. Affected: seeds created in any browser on iPhone or iPad, Safari on Mac before 18 Oct 2026, and the iOS app before July 2025.
- Attribution: none.
- Response: wallet 4.26.4 switches to crypto.getRandomValues(). About 87% of the stolen QU is frozen on-chain and MEXC froze the rest. Restitution is pending a Computor vote. The fix does not protect seeds already created.
Sources
- https://cryptobriefing.com/slowmist-qubic-wallet-key-recovery-flaw/
- https://investinglive.com/cryptocurrency/crypto-qubic-halts-network-after-weak-wallet-seeds-let-attacker-drain-1-404-wallets/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.