Recovering Private Keys from 6 Observations: Qubic Wallet Vulnerability Analysis

Key points

• Qubic disclosed on October 18 that attackers exploited insufficient wallet randomness to transfer about 2.94 trillion QU from 1,404 Qubic wallets, per the announcement.
• SlowMist found the wallet's seedGen() uses non-cryptographic Math.random(), while randomizeDejaVu() writes truncated outputs from the same stream into plaintext network packet headers.
• In a local PoC, six consecutive dejaVu values let SlowMist recover the 128-bit PRNG state, reconstruct the seed and match the private key.

AI summary of SlowMist’s report, written only from the publisher’s text. Read the original for full context.