Pinned Tweet
📢GoPlus #DeepScan Comprehensive Upgrade: A New Paradigm of AI-Powered Smart Contract Security.
Smart contracts hold funds — and hackers are already using AI to uncover deep-layer vulnerabilities. One-time audits can no longer keep pace with today's attack-defense dynamics. The ward AI-powered, continuous security: higher efficiency, lower cost, full-lifecycle protection.
GoPlus DeepScan delivers three interconnected modules forming a closed-loop, continuous security service for the entire smart contract lifecycle: AI Contract Audit, Continuous Security Monitoring, and Token Security Self-Check.
Features
AI Auditing
AI-powered deep analysis of contract source code, permission management, and business logic. Systematically detects syntax vulnerabilities and business-logic flaws, and delivers a structured audit report — including security scores, key findings, issue details, and remediation recommendations.
Security Monitoring
Post-audit, always-on assurance for live contracts. Tracks newly disclosed vulnerabilities, on-chain attacks, and status changes in external dependencies (oracles, cross-chain bridges) in real time. AI continuously assesses impact, triggers targeted re-reviews, and issues alerts — moving beyond the "audit as finish line" model.
Token Security Checking
A rapid pre-launch self-inspection tool for tokens preparing to launch or list. Identifies common high-risk characteristics in minutes, including: Honeypot detection, Malicious mint detection, Blacklist mechanism detection, Abnormal buy/sell tax detection, Owner privilege & trading restriction risks.
Benchmark
An open-source benchmark built from real-world attack incidents. Extracts vulnerable contract source code from attacked projects to systematically evaluate AI capabilities in vulnerability identification, attack-path understanding, contextual reasoning, and audit stability. Nearly 100 real, representative attack cases from May 2025 to date, continuously updated.
Use Cases
Developers — Cost-effective, high-efficiency security scanning with audit-grade quality, enabling fast, confident innovation.
Project Teams — Pre-launch scanning as a complement to traditional audits; continuous auditing and monitoring during operations to stay ahead of attackers.
Exchanges — Enhanced pre-listing security review efficiency and capability; continuous monitoring as routine risk control to catch new threats early and minimize post-listing incidents.
Get Started
GoPlus DeepScan is live — try it now: **deepscan.gopluslabs.io**
AI Auditing Benchmark: github.com/GoPlusSecurity…
Smart contracts hold funds — and hackers are already using AI to uncover deep-layer vulnerabilities. One-time audits can no longer keep pace with today's attack-defense dynamics. The ward AI-powered, continuous security: higher efficiency, lower cost, full-lifecycle protection.
GoPlus DeepScan delivers three interconnected modules forming a closed-loop, continuous security service for the entire smart contract lifecycle: AI Contract Audit, Continuous Security Monitoring, and Token Security Self-Check.
Features
AI Auditing
AI-powered deep analysis of contract source code, permission management, and business logic. Systematically detects syntax vulnerabilities and business-logic flaws, and delivers a structured audit report — including security scores, key findings, issue details, and remediation recommendations.
Security Monitoring
Post-audit, always-on assurance for live contracts. Tracks newly disclosed vulnerabilities, on-chain attacks, and status changes in external dependencies (oracles, cross-chain bridges) in real time. AI continuously assesses impact, triggers targeted re-reviews, and issues alerts — moving beyond the "audit as finish line" model.
Token Security Checking
A rapid pre-launch self-inspection tool for tokens preparing to launch or list. Identifies common high-risk characteristics in minutes, including: Honeypot detection, Malicious mint detection, Blacklist mechanism detection, Abnormal buy/sell tax detection, Owner privilege & trading restriction risks.
Benchmark
An open-source benchmark built from real-world attack incidents. Extracts vulnerable contract source code from attacked projects to systematically evaluate AI capabilities in vulnerability identification, attack-path understanding, contextual reasoning, and audit stability. Nearly 100 real, representative attack cases from May 2025 to date, continuously updated.
Use Cases
Developers — Cost-effective, high-efficiency security scanning with audit-grade quality, enabling fast, confident innovation.
Project Teams — Pre-launch scanning as a complement to traditional audits; continuous auditing and monitoring during operations to stay ahead of attackers.
Exchanges — Enhanced pre-listing security review efficiency and capability; continuous monitoring as routine risk control to catch new threats early and minimize post-listing incidents.
Get Started
GoPlus DeepScan is live — try it now: **deepscan.gopluslabs.io**
AI Auditing Benchmark: github.com/GoPlusSecurity…
20
2
19
6,869
1/7
⚠️ Exploit Breakdown: X100 Governance Hijack, ~$4.848M
On Oct 24, @x100global ($X) was hit by a flash-loan governance hijack.
In a single tx, the attacker took 2 of 3 Senate seats and executed a proposal immediately, forcing the treasury to sell X into a thin pool it had s pulled 4,848,988.78 USDT from the main pool. The attacker received 4,848,017.34 USDT (~$4.848M) and still holds 828,094.32 X unsold.
🔍 Root cause
Freezer ranks Senate seats by current frozen balance. Paying 100 X is enough to run immediately. Two seats = majority. A proposal can be submitted, voted, and executed in the same tx.
Governance can tell the treasury which pool to sell X into, with no effective minimum fill. A flash loan can rent the majority, then dump the treasury into an attacker-built thin pool.
🔍 Attack flow (Tx1):
etherscan.io/tx/0x38c60844f…
1️⃣ Rent the X used for voting.
Aave V3 aUSDT sends 1,942,457.637245 USDT to the executor. It spends 1,942,356.637245 USDT in the Uniswap V3 main pool `0x0d85edd90c94053fc5997551b1baa8a77aa02fa0` and buys 38,200.000002 X at 50.8470 USDT. The extra 101 USDT stays on the executor; 100 USDT of it later seeds the new pool.
⚠️ Exploit Breakdown: X100 Governance Hijack, ~$4.848M
On Oct 24, @x100global ($X) was hit by a flash-loan governance hijack.
In a single tx, the attacker took 2 of 3 Senate seats and executed a proposal immediately, forcing the treasury to sell X into a thin pool it had s pulled 4,848,988.78 USDT from the main pool. The attacker received 4,848,017.34 USDT (~$4.848M) and still holds 828,094.32 X unsold.
🔍 Root cause
Freezer ranks Senate seats by current frozen balance. Paying 100 X is enough to run immediately. Two seats = majority. A proposal can be submitted, voted, and executed in the same tx.
Governance can tell the treasury which pool to sell X into, with no effective minimum fill. A flash loan can rent the majority, then dump the treasury into an attacker-built thin pool.
🔍 Attack flow (Tx1):
etherscan.io/tx/0x38c60844f…
1️⃣ Rent the X used for voting.
Aave V3 aUSDT sends 1,942,457.637245 USDT to the executor. It spends 1,942,356.637245 USDT in the Uniswap V3 main pool `0x0d85edd90c94053fc5997551b1baa8a77aa02fa0` and buys 38,200.000002 X at 50.8470 USDT. The extra 101 USDT stays on the executor; 100 USDT of it later seeds the new pool.
8
2
22
6,487
6/7
6️⃣ Repay and move the profit out.
The executor repays Aave 1,943,428.866064 USDT, including a 971.228819 USDT fee. The remaining 4,749,726.096973 USDT goes first to the outer contract, then to the attacker EOA.
6️⃣ Repay and move the profit out.
The executor repays Aave 1,943,428.866064 USDT, including a 971.228819 USDT fee. The remaining 4,749,726.096973 USDT goes first to the outer contract, then to the attacker EOA.
1
0
0
355
7/7
📌 Addresses
Attackers:
`0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63` (Tx1)
`0xfc3facd67138966ab0c841e905b0c4bca1abe92f` (Tx2)
`0xdab137f390df77caa97fd492540e973fd5e2f8c8` (Tx3)
Attack contracts:
`0x89e903e4512f8a315cebd99c29a1e40eee6fe2c9` (Tx1)
`0x1ba033875fdcb4ab83caaa9e16adc44c4abcd5c4` (Tx2)
`0xc1fd840df75f3ae77281a6625fe2f2153fc736ca` (Tx3)
Vulnerable contract:
`0x79f35a33fe2813414851c4ae8daeacd14d822a46`
Main pool drained:
`0x0d85edd90c94053fc5997551b1baa8a77aa02fa0`
Senate helpers:
`0xe08107e7dc7c4540d139392e9d0fea99ca019f37` / `0x176d1ea0ee9569783c6f6e455f7be6171566619c` (Tx1)
`0xc2f69b21bea8f0c64cbd4597f262c80c993073ba` / `0xb21f45868dcaae3be7c842971ae61dd93d4c7cde` (Tx2, Tx3)
Attacker-created pools (treasury sold into):
`0x9a03c41c539880b51508bebbc2dde7b738f6f075` (Tx1, Tx3)
`0x503f83894ad3df6bf001ea79cef45f2672a2673b` (Tx2)
Txs:
etherscan.io/tx/0x38c60844f…
etherscan.io/tx/0x77c46e1aa…
etherscan.io/tx/0x7c49bf288…
📌 Addresses
Attackers:
`0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63` (Tx1)
`0xfc3facd67138966ab0c841e905b0c4bca1abe92f` (Tx2)
`0xdab137f390df77caa97fd492540e973fd5e2f8c8` (Tx3)
Attack contracts:
`0x89e903e4512f8a315cebd99c29a1e40eee6fe2c9` (Tx1)
`0x1ba033875fdcb4ab83caaa9e16adc44c4abcd5c4` (Tx2)
`0xc1fd840df75f3ae77281a6625fe2f2153fc736ca` (Tx3)
Vulnerable contract:
`0x79f35a33fe2813414851c4ae8daeacd14d822a46`
Main pool drained:
`0x0d85edd90c94053fc5997551b1baa8a77aa02fa0`
Senate helpers:
`0xe08107e7dc7c4540d139392e9d0fea99ca019f37` / `0x176d1ea0ee9569783c6f6e455f7be6171566619c` (Tx1)
`0xc2f69b21bea8f0c64cbd4597f262c80c993073ba` / `0xb21f45868dcaae3be7c842971ae61dd93d4c7cde` (Tx2, Tx3)
Attacker-created pools (treasury sold into):
`0x9a03c41c539880b51508bebbc2dde7b738f6f075` (Tx1, Tx3)
`0x503f83894ad3df6bf001ea79cef45f2672a2673b` (Tx2)
Txs:
etherscan.io/tx/0x38c60844f…
etherscan.io/tx/0x77c46e1aa…
etherscan.io/tx/0x7c49bf288…
0
0
0
358
Older iOS flaws are being exploited to steal Web3 keys and crypto. #Coruna and #DarkSword fuel exploit trading, malware sales, phishing and trojanized apps. Our report breaks down the attacks, operators, money trails and how to stay safe 👇 x.com/i/article/2113…
5
2
13
4,097
⚠️ Exploit breakdown: WAX multi-chain bridge
On Oct 22, the @WAX_io bridge across WAX / Solana / Ethereum was attacked. The attacker “withdrew” mapped tokens on the WAX side without paying anything. The Solana and Ethereum sides still paid out as normal. Five withdrawals in ,558 USDT, 840 DAI, 2.55 WETH, 0.11 WBTC.
Root cause: a negative fee on `withdraw` zeroed the debit
The WAX-side bridge contract `eth.token` — the mint and bridge-accounting contract for mapped tokens WAXUSDC / WAXUSDT / WAXDAI / WAXWETH / WAXWBTC, issuer `bridge.wax` — has a signed-amount check flaw in `withdraw(from, to_eth_address, quantity, max_fee, chain_name)`:
• The contract charges `debit = quantity + fee`, and intends `max_fee ≥ 0`.
• The attacker set `max_fee` to `quantity` (for a 52,986.497732 WAXUSDC withdrawal, they passed `52,986.497732`). The actual debit was exactly 0.
• When the debit was zero, the contract skipped the balance-deduction and check path (a zero-amount transfer does not trigger `sub_balance`). The withdrawal still posted and created a cross-chain withdrawal record.
Attacker account `fasdfas.al` held a balance of zero on `eth.token` for all five tokens the whole time (`get_currency_balance` all 0). No payment was made at any point.
waxblock.io/transaction/40…
📌 Attacker addresses
WAX: waxblock.io/account/fasdfa…
Solana: solscan.io/account/4H1piN…
Ethereum: etherscan.io/address/0x0166…
Exploited contract:
waxblock.io/account/eth.to…
Example attack tx:
waxblock.io/transaction/40…
On Oct 22, the @WAX_io bridge across WAX / Solana / Ethereum was attacked. The attacker “withdrew” mapped tokens on the WAX side without paying anything. The Solana and Ethereum sides still paid out as normal. Five withdrawals in ,558 USDT, 840 DAI, 2.55 WETH, 0.11 WBTC.
Root cause: a negative fee on `withdraw` zeroed the debit
The WAX-side bridge contract `eth.token` — the mint and bridge-accounting contract for mapped tokens WAXUSDC / WAXUSDT / WAXDAI / WAXWETH / WAXWBTC, issuer `bridge.wax` — has a signed-amount check flaw in `withdraw(from, to_eth_address, quantity, max_fee, chain_name)`:
• The contract charges `debit = quantity + fee`, and intends `max_fee ≥ 0`.
• The attacker set `max_fee` to `quantity` (for a 52,986.497732 WAXUSDC withdrawal, they passed `52,986.497732`). The actual debit was exactly 0.
• When the debit was zero, the contract skipped the balance-deduction and check path (a zero-amount transfer does not trigger `sub_balance`). The withdrawal still posted and created a cross-chain withdrawal record.
Attacker account `fasdfas.al` held a balance of zero on `eth.token` for all five tokens the whole time (`get_currency_balance` all 0). No payment was made at any point.
waxblock.io/transaction/40…
📌 Attacker addresses
WAX: waxblock.io/account/fasdfa…
Solana: solscan.io/account/4H1piN…
Ethereum: etherscan.io/address/0x0166…
Exploited contract:
waxblock.io/account/eth.to…
Example attack tx:
waxblock.io/transaction/40…
ℹ️ We are aware of an incident affecting the WAX Multi-Chain Bridge and are investigating. We paused bridge processing as a precaution.
Please don't submit bridge transfers until we confirm the bridge is back online.
The exploit affected only a small number of stablecoins. WAXP tokens were unaffected. The WAX blockchain itself was not affected and continues to operate normally. The issue is confined to a bridge application contract.
1
4
23
4,792
🚨 GoPlus Security Alert: Node.js October 2026 Security Updates
On Oct 21, Node.js patched 10 vulnerabilities: 4 high-, 3 medium-, and 3 low-severity. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It can lead to remote code execution when an app processes untrusted compressed data. The other high-severity issues are `dns.resolve` truncating domain names that contain NUL characters, and two TLS certificate hostname-verification bypasses. The medium- and low-severity issues cover Keep-alive response handling, repeated random values, ZIP file handling, and the permission model.
Patched releases: Node.js 22.23.4, 24.22.1, 26.12.1. Affected release lines vary by vulnerability. Running Node.js does not by itself mean there is an exploitable entry point.
nodejs.org/en/blog/vulner…
⚠️ Checks and mitigation steps
1. Know what is actually running. Inventory the Node.js executable and image source actually in use across services, nodes, and containers, and check every replica. The version reported by a local `node -v` command may differ from the version used by the application process.
2. Prioritize upgrades based on exposure. Prioritize services that decode Brotli-compressed data from external sources, or that use untrusted input to construct DNS queries or specify HTTPS/TLS connection targets. Move to the patched release for that branch, or a verified vendor backport. Then restart and verify the running version on every node.
3. If you cannot upgrade now, restrict exposed inputs. Restrict the processing of untrusted compressed data, and limit which connection targets can be specified through untrusted input. Review logs for decoding errors, abnormal process behavior, and certificate alerts. These measures do not replace a runtime update.
On Oct 21, Node.js patched 10 vulnerabilities: 4 high-, 3 medium-, and 3 low-severity. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It can lead to remote code execution when an app processes untrusted compressed data. The other high-severity issues are `dns.resolve` truncating domain names that contain NUL characters, and two TLS certificate hostname-verification bypasses. The medium- and low-severity issues cover Keep-alive response handling, repeated random values, ZIP file handling, and the permission model.
Patched releases: Node.js 22.23.4, 24.22.1, 26.12.1. Affected release lines vary by vulnerability. Running Node.js does not by itself mean there is an exploitable entry point.
nodejs.org/en/blog/vulner…
⚠️ Checks and mitigation steps
1. Know what is actually running. Inventory the Node.js executable and image source actually in use across services, nodes, and containers, and check every replica. The version reported by a local `node -v` command may differ from the version used by the application process.
2. Prioritize upgrades based on exposure. Prioritize services that decode Brotli-compressed data from external sources, or that use untrusted input to construct DNS queries or specify HTTPS/TLS connection targets. Move to the patched release for that branch, or a verified vendor backport. Then restart and verify the running version on every node.
3. If you cannot upgrade now, restrict exposed inputs. Restrict the processing of untrusted compressed data, and limit which connection targets can be specified through untrusted input. Review logs for decoding errors, abnormal process behavior, and certificate alerts. These measures do not replace a runtime update.
3
1
8
4,254
Node.js Oct 21 vulnerability analysis and a security self-check Skill, now updated: github.com/GoPlusSecurity…
1
0
1
426
🚨 GoPlus Security Alert: Two unauthenticated RCE vulnerabilities in PHP
PHP’s official security advisory confirms CVE-2026-109618 and CVE-2026-109619 can both lead to unauthenticated remote code execution. Patched releases are available: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Lv
⚠️ Checks and mitigation steps
1. Know what is actually running. List each entry point, service, node/container, PHP SAPI, the executable path and PHP version used by each running worker, vendor package or image source, config overrides, and public reachability.
2. Upgrade first. Schedule public-facing mod_php first, then other internet-facing PHP services and any internal service that untrusted requests can reach. Move to the patched release for that branch, or a vendor package with a verified backport. Check compatibility and prepare backups and a rollback plan before upgrading. After the upgrade, restart all workers and verify the running PHP version on every node.
3. If you cannot upgrade now, reduce public exposure. Restrict external access. Review upload and input size limits, and request limits.
PHP’s official security advisory confirms CVE-2026-109618 and CVE-2026-109619 can both lead to unauthenticated remote code execution. Patched releases are available: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Lv
⚠️ Checks and mitigation steps
1. Know what is actually running. List each entry point, service, node/container, PHP SAPI, the executable path and PHP version used by each running worker, vendor package or image source, config overrides, and public reachability.
2. Upgrade first. Schedule public-facing mod_php first, then other internet-facing PHP services and any internal service that untrusted requests can reach. Move to the patched release for that branch, or a vendor package with a verified backport. Check compatibility and prepare backups and a rollback plan before upgrading. After the upgrade, restart all workers and verify the running PHP version on every node.
3. If you cannot upgrade now, reduce public exposure. Restrict external access. Review upload and input size limits, and request limits.
1
0
5
3,380
php2shell RCE analysis and a security self-check Skill. Check it item by item against your business use case: github.com/GoPlusSecurity…
0
0
1
375
1/2
🎁 DeepScan Community Nominations · Round 3 | Web3 Security Hot Topics
Quantum computing takes another leap. OpenAI’s math results are all over the timeline. The community is asking: Can Bitcoin hold up? Could smart contracts get rekt?
CryptoBilis, a Ledger reseller, s. About $100M was stolen. Which is safer: a hardware wallet, or an offline iPhone?
Binance’s .ai domain is lighting up agentic wallets. How do you use an agent wallet without getting drained?
Which topic do you care about most? GoPlus will publish a security research report based on the votes.
🎟️ Giveaway: 10 eligible participants win 10 USDT each.
🗳️ How to enter:
1. Follow @GoPlusSecurity and repost.
2. Vote in the thread post “2/2”.
3. Voting closes October 26 at 23:00 UTC. Winners and the security report will be announced afterward.
🎁 DeepScan Community Nominations · Round 3 | Web3 Security Hot Topics
Quantum computing takes another leap. OpenAI’s math results are all over the timeline. The community is asking: Can Bitcoin hold up? Could smart contracts get rekt?
CryptoBilis, a Ledger reseller, s. About $100M was stolen. Which is safer: a hardware wallet, or an offline iPhone?
Binance’s .ai domain is lighting up agentic wallets. How do you use an agent wallet without getting drained?
Which topic do you care about most? GoPlus will publish a security research report based on the votes.
🎟️ Giveaway: 10 eligible participants win 10 USDT each.
🗳️ How to enter:
1. Follow @GoPlusSecurity and repost.
2. Vote in the thread post “2/2”.
3. Voting closes October 26 at 23:00 UTC. Winners and the security report will be announced afterward.
313
396
399
8,965
GoPlus Security 🚦 retweeted
🎙️ Tonight on Cregis MicUp: Digital Asset Security in Practice
🗓️ October 21 | 5:00 PM GMT+8
📍 Live on X Spaces
Bring your questions and join us here: x.com/i/spaces/1rxmq…
What should businesses check before an incident, and prioritize after one?
Join Max om @range_org , Dmytro Matviiv(@DmytroMatviiv ) from @HackenProof and Bobby from @GoPlusSecurity for a conversation on overlooked risks, practical safeguards, incident response and the security questions AI brings to digital asset operations.
Hosted by @bojun_li , Deputy Marketing Director at @0xCregis .
#DigitalAssets #CyberSecurity #CregisMicUp
🗓️ October 21 | 5:00 PM GMT+8
📍 Live on X Spaces
Bring your questions and join us here: x.com/i/spaces/1rxmq…
What should businesses check before an incident, and prioritize after one?
Join Max om @range_org , Dmytro Matviiv(@DmytroMatviiv ) from @HackenProof and Bobby from @GoPlusSecurity for a conversation on overlooked risks, practical safeguards, incident response and the security questions AI brings to digital asset operations.
Hosted by @bojun_li , Deputy Marketing Director at @0xCregis .
#DigitalAssets #CyberSecurity #CregisMicUp
4
5
14
961
South Korean financial firms reported customer data breaches in a row. One attacker, using ARTEX and large models, did alone what took a full team. AI flattened capability costs on both sides. The gap is who inspects their systems first. Act now. x.com/i/article/2112…
0
0
4
2,963
1/6
⚠️ Qubic weak-seed exploit breakdown: 1,404 wallets on Apple platforms drained, ~$1.3M
From Oct 17–18, attackers exploited the @Qubic official Web wallet on Apple platforms (WebKit / JavaScriptCore). Seeds were generated with Math.random(). They enumerated all 2^32 possible ched the derived addresses to 1,404 funded wallets, and drained 2,939,606,531,944 QU (~$1.3M).
Qubic then initiated a protective shutdown. 87.1% of the stolen funds are frozen on-chain. The remaining 12.9% was sent to MEXC, where the receiving account was frozen. Web wallet v4.26.4 is out — it switches to crypto.getRandomValues. Affected users should update.
I. Who is affected
1,404 wallet addresses. Shared trait: the seed was generated by the official Qubic client in a weak-entropy environment.
▪️ Seeds generated before Oct 18, 2026, in any browser on iPhone / iPad (Safari, Chrome, Firefox — all forced onto WebKit)
▪️ Seeds generated before Oct 18, 2026, in Safari on MacBook / iMac
▪️ Seeds generated before July 2025 in the Qubic iOS App
II. Root cause: insufficient entropy from Math.random()
A Qubic seed is a 55-char lowercase string. Theoretical space is 26^55 (≈2^258). Actual security depends on the entropy of the PRNG’s internal state that produced it.
⚠️ Qubic weak-seed exploit breakdown: 1,404 wallets on Apple platforms drained, ~$1.3M
From Oct 17–18, attackers exploited the @Qubic official Web wallet on Apple platforms (WebKit / JavaScriptCore). Seeds were generated with Math.random(). They enumerated all 2^32 possible ched the derived addresses to 1,404 funded wallets, and drained 2,939,606,531,944 QU (~$1.3M).
Qubic then initiated a protective shutdown. 87.1% of the stolen funds are frozen on-chain. The remaining 12.9% was sent to MEXC, where the receiving account was frozen. Web wallet v4.26.4 is out — it switches to crypto.getRandomValues. Affected users should update.
I. Who is affected
1,404 wallet addresses. Shared trait: the seed was generated by the official Qubic client in a weak-entropy environment.
▪️ Seeds generated before Oct 18, 2026, in any browser on iPhone / iPad (Safari, Chrome, Firefox — all forced onto WebKit)
▪️ Seeds generated before Oct 18, 2026, in Safari on MacBook / iMac
▪️ Seeds generated before July 2025 in the Qubic iOS App
II. Root cause: insufficient entropy from Math.random()
A Qubic seed is a 55-char lowercase string. Theoretical space is 26^55 (≈2^258). Actual security depends on the entropy of the PRNG’s internal state that produced it.
Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next.
27
18
102
12,157
5/6
IV. Fix: crypto.getRandomValues(bytes)
After the incident, Qubic shipped v4.26.4 (github.com/qubic/wallet/r…).
The updated implementation uses crypto.getRandomValues(bytes) to fill a Uint8Array with random bytes from 0 to 255, drawn from the browser CSPRNG. This fixes in seed generation.
IV. Fix: crypto.getRandomValues(bytes)
After the incident, Qubic shipped v4.26.4 (github.com/qubic/wallet/r…).
The updated implementation uses crypto.getRandomValues(bytes) to fill a Uint8Array with random bytes from 0 to 255, drawn from the browser CSPRNG. This fixes in seed generation.
1
0
1
433
6/6
V. A recurring problem: weak randomness in 2026
1️⃣ Ill Bloom / legacy CryptoJS weak RNG. Multiple thefts from May–Aug 2026. Coinspect found some wallets still used CryptoJS’s weak RNG when generating recovery phrases. Confirmed apps: RRWallet, Bexo, NanChat, Bitcoin Libre, Milo. Loss about $5.7M.
coinspect.com/blog/ill-bloom…
2️⃣ Coldcard hardware wallet. On July 30, 2026, weak-entropy seeds from old Coldcard firmware were exploited. 1,816 BTC (~$116M) across 5,200+ addresses.
coldcard.com/security/status
These cases show the same pattern. In the AI era, the barrier to exploiting cryptographic weaknesses — particularly implementation flaws — is falling rapidly. Audits have to cover the real entropy source at seed creation, the platform RNG, and old dependencies. Checking key length, shipping a new client, or locking down custody after generation cannot eliminate the risk of seeds that were already weak.
V. A recurring problem: weak randomness in 2026
1️⃣ Ill Bloom / legacy CryptoJS weak RNG. Multiple thefts from May–Aug 2026. Coinspect found some wallets still used CryptoJS’s weak RNG when generating recovery phrases. Confirmed apps: RRWallet, Bexo, NanChat, Bitcoin Libre, Milo. Loss about $5.7M.
coinspect.com/blog/ill-bloom…
2️⃣ Coldcard hardware wallet. On July 30, 2026, weak-entropy seeds from old Coldcard firmware were exploited. 1,816 BTC (~$116M) across 5,200+ addresses.
coldcard.com/security/status
These cases show the same pattern. In the AI era, the barrier to exploiting cryptographic weaknesses — particularly implementation flaws — is falling rapidly. Audits have to cover the real entropy source at seed creation, the platform RNG, and old dependencies. Checking key length, shipping a new client, or locking down custody after generation cannot eliminate the risk of seeds that were already weak.
0
0
2
367