Math.random() picks $1.4M worth of losers as Qubic hits pause

Qubic halted operations on October 18 after an attacker drained approximately 2.94 trillion QU, valued at roughly $1.4 million, from 1,404 wallets in about 104 minutes. Validators, known as Computors, stopped the chain at tick 85,371,949 once the exploit was detected. The incident stemmed from a weak random number generator in the wallet's seed creation layer rather than a flaw in the underlying protocol.

The attacker targeted JavaScript's Math.random() function, which is not designed for cryptographic secret generation. Seeds produced through this method follow a repeatable pattern, allowing the actor to reconstruct wallet seeds without brute force. The affected wallets were those created in any browser on iPhone or iPad, as well as in Safari on Mac prior to a recent update, according to project disclosures.

Validators froze 87.1% of the exposed funds on-chain, while exchange MEXC froze the remaining balance within an hour of being notified. Qubic deployed a patch, version 4.26.4, that replaces the vulnerable seed generation process. The project's team stated that no protocol consensus mechanism was compromised and that the freeze was coordinated entirely by Computors operating within their authority.

The $QU token is the native asset of the Qubic layer-1 network, which uses a quorum of Computors to validate transactions through a useful proof-of-work cycle. Qubic has not announced a timeline for chain resumption but said affected users would be able to migrate funds to newly generated wallets using the patched client once the freeze is lifted.