Blockchain security firm SlowMist has published its postmortem analysis on the Qubic Wallet, revealing that private keys could be recovered from as few as six network observations due to weak random number generation.
The analysis follows an October 18, 2026, breach in which approximately 2.94 trillion QU, valued at roughly $1.3 million, was drained from 1,404 wallets within a matter of hours.
A Weak Random Number Generator
According to SlowMist, the root issue stemmed from how the wallet created seeds, which serve as the master secrets generating account private keys. The Qubic Wallet used JavaScript's Math.random() function to construct seeds as 55-character strings of lowercase letters.
While the theoretical seed space of 26^55 suggests that brute-forcing should be practically impossible, the weak pseudorandom number generator (PRNG) state significantly reduced the complexity. SlowMist determined that attackers effectively faced only about 2^32 possibilities, a space small enough to brute-force.
Network Exposure and Vulnerable Environments
Outputs from the random stream were exposed in plaintext through a protocol request header field named dejaVu. Observers monitoring network traffic could collect these values and potentially recover private keys with as few as six observations.
The vulnerability primarily impacted weak-entropy environments, specifically affecting Safari on Mac prior to October 18, 2026, and the Qubic iOS app before July 2025. SlowMist identified iOS and iPadOS devices more broadly as higher-risk groups, emphasizing that the flaw resided in the wallet implementation rather than the core Qubic protocol.
Network Halt, Fund Freezing, and Patches
Following the October 18 breach, Qubic halted its network at tick 85,371,949. Validators successfully froze approximately 87.1% of the stolen funds on-chain, while the MEXC exchange froze the remaining 12.9%.
On the same day, Qubic released web wallet version 4.26.4, replacing Math.random() with the cryptographically secure crypto.getRandomValues() function. The update separates new account seed generation from the random stream exposed in the headers, though the dejaVu header generation process itself remained unchanged.
SlowMist noted that the patch prevents future vulnerabilities but cannot retroactively secure existing seeds, making the platform and timing of seed creation critical for assessing individual exposure.
