SlowMist traces Qubic wallet theft to weak randomness in seed generation

The security firm says Qubic's web wallet used Math.random() for private key seeds, a flaw tied to the theft of approximately 2.94 trillion QU from 1,404 wallets Blockchain security firm SlowMist has published a postmortem on the Qubic Wallet. Its finding is uncomfortable: some private keys could be recovered from as few as six network observations. The analysis, released on October 20, 2026, follows an October 18 breach. In that breach, approximately 2.94 trillion QU, valued at around $1.3 million, was drained from 1,404 wallets within hours. The root problem sits in how the wallet created seeds. Seeds are the master secrets that generate account private keys. According to SlowMist, Qubic Wallet built these seeds with JavaScript’s Math.random() function. Each seed was a 55-character string of lowercase letters.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Crypto Briefing.