SlowMist published a postmortem on the Qubic Wallet breach. The security firm found that the web wallet used Math.random() to generate private key seeds, creating a vulnerability that allowed attackers to determine the PRNG state with as few as six network observations. Approximately 2.94 trillion QU (~$1.3 million) was drained from 1,404 wallets within hours on October 18, 2026. Qubic halted its network and froze 87.1% of the stolen funds on-chain, with the remaining 12.9% frozen by the MEXC exchange. The vulnerability mainly affected weak-entropy environments, particularly Safari on Mac and the Qubic iOS app, and was fixed in web wallet version 4.26.4.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
