Qubic: 1,404 wallets drained (about $1.3M) because seeds were generated with Math.random

Between 23:42 UTC on Oct 17 and 01:26 UTC on Oct 18 2026 an attacker drained 1,404 Qubic wallets of about 2.94 trillion QU (roughly $1.3M to $1.4M). SlowMist traced it to wallet seeds generated with non-cryptographic Math.random, affecting seeds created in iPhone/iPad browsers, Mac Safari before Oct 18, and the iOS app before July 2025. Qubic halted the network; 87.1% of the funds are frozen on-chain and MEXC froze the rest. Wallet 4.26.4 switches to crypto.getRandomValues, but seeds already created stay weak.

Why this severity: ~$1.3M drained; existing weak seeds remain exposed until funds move

Started

Oct 17, 2026

• #Crypto