SlowMist traces Qubic wallet theft to weak randomness in seed generation

Blockchain security firm SlowMist has published a postmortem on the Qubic Wallet. Its finding is uncomfortable: some private keys could be recovered from as few as six network observations. The analysis, released on October 20, 2026, follows an October 18 breach. In that breach, approximately 2.94 trillion QU, valued at around $1.3 million, was drained from 1,404 wallets within hours. A random number generator that wasn’t random enough The root problem sits in how the wallet created seeds. Seeds are the master secrets that generate account private keys. According to SlowMist, Qubic Wallet built these seeds with JavaScript’s Math.random() function. Each seed was a 55-character string of lowercase letters. On paper, the seed format looks very strong. SlowMist noted the theoretical seed space is 26^55, a number so large that guessing a seed by brute force should be hopeless. In practice, the weak PRNG state undermined that math. SlowMist found that an attacker effectively faced about 2^32 possibilities, which is small enough to brute-force. The leak in the headers SlowMist reported that outputs from the same random stream were exposed in plaintext through a field called dejaVu. That f...