Math.random had a bad day: Qubic restarts after $1.4 million seed drain

Qubic restarted its layer-1 blockchain at 8:00 pm on Oct. 19 and launched a recovery claims process after validators known as Computors approved a plan for funds drained from 1,404 wallets. Qubic’s blockchain explorer showed the network advancing beyond tick 85,371,949, where it had been halted on Sunday. Affected users can check their address and submit a claim through Qubic’s reclaim platform until May 1, 2027.

The attacker removed approximately 2.94 trillion Qubit (QU), worth roughly $1.4 million, during an exploit that lasted about 104 minutes. Qubic halted operations on October 18, 2026, with Computors stopping the chain at tick 85,371,949. The project said the cause was a weak random number generator in the wallet seed-creation layer, not a protocol bug: JavaScript’s Math.random(), which is not designed for cryptographic secrets, produced predictable seeds that the attacker reconstructed without brute force.

The vulnerability affected seeds created in any browser on an iPhone or iPad, in Safari on a Mac until Oct. 18, 2026, or through the Qubic iOS app before July 2025. Qubic said: “87.1% of the drained funds never left the Qubic network and remain frozen in place.” “The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour.” The project said it would publish a full technical report after a recovery plan was settled.

Qubic fixed the seed-generation flaw in web wallet version 4.26.4. A GitHub commit for version 4.26.4 shows that Math.random() was replaced with the cryptographically secure crypto.getRandomValues() function. “If you created your wallet with the Qubic web wallet before version 4.26.4 (released 19 October), treat it as insecure, even if your funds were never touched,” said Qubic on Tuesday. “Update to web wallet 4.26.4 or later, then create a new wallet,” said the team. “Move your funds to the new wallet as soon as you can, and never use the old one again.”

The incident followed July’s disclosure by Coldcard that attackers had stolen funds from wallets whose seeds were weakened by a firmware bug. Similar flaws affected Trust Wallet’s browser extension and the Libbitcoin Explorer tool in 2023.

Qubic supports transactions and smart contracts without fees and uses Useful Proof of Work (UPoW), a consensus mechanism that repurposes mining energy to train artificial intelligence. Its token had a market capitalization of about $62.6 million at the time of writing, according to CoinGecko. AMLBot’s 2026 investigations report, which covered 250 investigations opened since the start of the year, found that hacks and exploits accounted for 19% of crypto crime cases but 40% of reported losses in the third quarter.