SlowMist Rebuilds Qubic Private Key From Six Header Values in Local Test
Photo: TokenPost
SlowMist reconstructed a Qubic wallet’s private key in a local test using six consecutive network header values, revealing a possible route from observable traffic to a weak wallet seed. The finding follows the theft of about 2.94 trillion QU, units of Qubic (QUBIC), from 1,404 wallets. The transfers occurred between 7:42 and 9:26 p.m. ET on Oct. 17 (23:42 UTC Oct. 17 to 01:26 UTC Oct. 18). The affected wallets had seeds generated with insufficient randomness. Before a patch, Qubic’s web wallet used Math.random() to create seeds and to fill a request-header field called dejaVu.
Source: TokenPost
