SECURITY ALERT

UPDATED 22:51 UTC, 20 Oct. Qubic said on Tuesday evening that its Computor quorum had approved the recovery of weak-seed wallets and opened a reclaim site, weak-seed-reclaim.qubic.org, with claims open until 1 May 2027. It also told anyone who created a wallet in its web wallet before version 4.26.4 to make a new one and move their funds. Our follow-up has the details.

A secret is only as good as the dice that made it.

Qubic’s web wallet, says one security firm, used the same dice for something it shouted across the network.

Security firm SlowMist said on Tuesday that Qubic’s web wallet drew both its account seeds and a value written into every network request from the same weak random-number stream, and that six observed values were enough for its test code to rebuild a seed, in an analysis published on Medium.

SlowMist is careful about what that proves.

Its proof of concept ran locally and “verifies the information-theoretic feasibility of the process”, the firm wrote. Whether a real attack works depends on who can see the traffic and other conditions, it said.

It does not say this is how 1,404 Qubic wallets were drained on 17 and 18 Oct.

Qubic has not said so either.

The timeline, in UTC

So what exactly did SlowMist find?

One stream, two jobs

A computer’s ordinary random-number function is a pseudo-random generator: a formula that looks random but follows from a hidden internal state.

JavaScript’s Math.random() is that kind of function. It is fine for games. It is not built for secrets.

Before 18 Oct, the wallet built each 55-letter seed with Math.random(), one letter at a time, SlowMist says.

In V8, the JavaScript engine it analysed, the whole stream comes from a 128-bit internal state that is itself built from a single 64-bit starting value. That caps the possible streams at about 2^64, far below what 55 random letters suggest.

That alone, SlowMist says, is not enough for an outsider.

The second piece is a field called dejaVu. A Qubic library used by the wallet fills it with the same Math.random() stream and writes it into the header of each request, every 2 seconds for tick updates and every 30 seconds for balance checks.

Those requests go to a default bridge, a relay server at webbridge.qubic.li. SlowMist says the bridge forwards them to network peers over unencrypted connections.

Anyone in that path, the bridge, a peer or someone watching the plain-text link, could collect the values.

SlowMist fed six consecutive values into a solver. It recovered the generator’s full internal state in about 15 milliseconds, then rebuilt the seed and checked it against the public key the wallet had already sent in its balance requests.

The keys matched.

Has that door been closed?

What changed, and what did not

The 18 Oct fix replaced the wallet’s seed function with crypto.getRandomValues(), the browser’s cryptographic source, the commit shows.

The commit does not touch the dejaVu code, which lives in a separate library.

By our reading, that matters less now: once seeds no longer come from Math.random(), the values in the headers no longer reveal anything about new keys. Old seeds are another matter.

The chain was running on Tuesday. Our read of Qubic’s public RPC at 10:07 UTC showed tick 85,469,738 in epoch 235.

The escrow is still there. Qubic’s official X account has posted nothing since its 18 Oct statement, and no process for reclaiming swept funds has been announced.

So whose seeds were exposed, and how?

What we do not know

  • Whether the attacker used this route, or another way to predict the weak seeds.
  • How SlowMist’s model, built on V8, the engine in Chrome and other Chromium browsers, fits Qubic’s statement that affected seeds were made on iPhones and iPads and in Safari on Macs, which run Apple’s WebKit. SlowMist’s write-up does not address it.
  • Who could see the bridge-to-peer traffic, and for how long.
  • When and how owners of escrowed funds can claim them.

Protect yourself

  • If you made a seed in Qubic’s web wallet before 18 Oct and it is not frozen, consider moving funds to a new seed made in wallet 4.26.4 or later. If it is frozen, wait for Qubic’s official channels; the network drops its transactions.
  • Builders: never generate keys with Math.random(), and never let any output of the generator that made a key leave the device.
  • No one legitimate will ask for your seed to “unlock” escrowed QU (why the seed is the master key).

If six numbers in a packet header can give away a key, what else is your wallet saying out loud?

Corrections and new evidence: [email protected]

Related: Liquid restores swaps but keeps peg-outs shut

This article is for information only and is not investment advice.