A local test by security firm SlowMist found that six consecutive network header samples could expose a Qubic wallet key, underscoring risks in seeds created before a patch.
In an Oct. 20 analysis, SlowMist said it recovered a wallet private key using six consecutive values from the dejaVu field in network request headers. Before the update, Qubic’s web wallet used JavaScript’s Math.random() both for that field and to create seeds, the secrets used to derive wallet keys.
SlowMist traced the observed values back to the random-number generator’s internal state before matching the resulting private key. With only four or five samples, the solver could not isolate one state; the successful result also required consecutive values and correctly aligned generator calls.
The wallet-to-default-bridge connection was encrypted, but SlowMist identified the bridge-to-peer link, where traffic was plaintext, as a possible observation point. Its analysis did not establish that the thief used this route or that the method would work on every affected device.
Qubic released web wallet version 4.26.4 on Oct. 18, moving new seed creation to crypto.getRandomValues() while leaving Math.random() in use for the dejaVu field. Seeds retain the randomness they had when they were created.
The analysis follows the Oct. 17 wallet breach, when Qubic said about 2.94 trillion QU, units of Qubic (QUBIC), had been taken from 1,404 wallets. Qubic said the affected seeds had insufficient randomness and that the underlying network protocol was unaffected.
Qubic halted its network after the breach and said 87.1% of the stolen tokens remained frozen on-chain. Freezing them has not returned the assets to their owners. The Computor quorum must decide how the frozen funds are handled.
