# Qubic: 1,404 wallets drained (about $1.3M) because seeds were generated with Math.random · pwn.watch > Between 23:42 UTC on Oct 17 and 01:26 UTC on Oct 18 2026 an attacker drained 1,404 Qubic wallets of about 2.94 trillion QU (roughly $1.3M to $1.4M). SlowMist traced it to wallet seeds generated with non-cryptographic Math.random, affecting seeds created in iPhone/iPad browsers, Mac Safari before Oct 18, and the iOS app before July 2025. Qubic halted the network; 87.1% of the funds are frozen on-chain and MEXC froze the rest. Wallet 4.26.4 switches to crypto.getRandomValues, but seeds already created stay weak. Page: https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026 · generated 2026-10-24T08:44:16.553Z ## Status - Severity: high · status: live · patch: partial - Product: Qubic wallet (web and iOS) - Started: 2026-10-17 - Affected: Seeds created in iPhone/iPad browsers, Mac Safari before 2026-10-18, iOS app before July 2025 - Fixed in: Qubic wallet 4.26.4 (new seeds only) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026.json - This file: https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026/llms.txt ## Updates (newest first) - 2026-10-20: SlowMist publishes its analysis tracing the theft to weak randomness in seed generation. (https://slowmist.medium.com/recovering-private-keys-in-just-6-connections-qubic-wallet-may-have-leaked-most-of-its-private-d87b520dccf6) - 2026-10-18: Qubic halts the network; wallet 4.26.4 replaces Math.random seed generation with crypto.getRandomValues. (https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds) - 2026-10-17: An attacker drains 1,404 Qubic wallets between 23:42 UTC Oct 17 and 01:26 UTC Oct 18. (https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds) ## Fix brief # Security brief: Qubic: 1,404 wallets drained (about $1.3M) because seeds were generated with Math.random Source: https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026 · status: live · severity: high · updated Oct 24, 2026, 06:40 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Between 23:42 UTC on Oct 17 and 01:26 UTC on Oct 18 2026 an attacker drained 1,404 Qubic wallets of about 2.94 trillion QU (roughly $1.3M to $1.4M). SlowMist traced it to wallet seeds generated with non-cryptographic Math.random, affecting seeds created in iPhone/iPad browsers, Mac Safari before Oct 18, and the iOS app before July 2025. Qubic halted the network; 87.1% of the funds are frozen on-chain and MEXC froze the rest. Wallet 4.26.4 switches to crypto.getRandomValues, but seeds already created stay weak. Severity detail: ~$1.3M drained; existing weak seeds remain exposed until funds move - Product: Qubic wallet (web and iOS) ## Affected versions - Seeds created in iPhone/iPad browsers, Mac Safari before 2026-10-18, iOS app before July 2025 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Qubic wallet 4.26.4 (new seeds only) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes Qubic users whose seed was created on iOS/iPadOS browsers, Mac Safari before 2026-10-18, or the iOS app before July 2025 should create a new seed with wallet 4.26.4+ and move funds. Updating the wallet alone does not fix an existing seed. ## Latest updates - Oct 20, 2026: SlowMist publishes its analysis tracing the theft to weak randomness in seed generation. - Oct 18, 2026: Qubic halts the network; wallet 4.26.4 replaces Math.random seed generation with crypto.getRandomValues. - Oct 17, 2026: An attacker drains 1,404 Qubic wallets between 23:42 UTC Oct 17 and 01:26 UTC Oct 18. ## Write-ups & news - [Qubic Halts Blockchain After $1.4M Wallet Theft](https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds) - [Recovering private keys in just 6 connections: Qubic wallet may have leaked most of its private keys](https://slowmist.medium.com/recovering-private-keys-in-just-6-connections-qubic-wallet-may-have-leaked-most-of-its-private-d87b520dccf6) - [SlowMist traces Qubic wallet theft to weak randomness in seed generation](https://cryptobriefing.com/slowmist-qubic-wallet-key-recovery-flaw/) --- Machine-readable: https://pwn.watch/i/qubic-wallets-weak-seed-drain-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.