@The_NewsCrypto Numbers match the advisory: 1,404 wallets, ~2.94T QU, 87.1% frozen on-chain. For users: if your seed was made on the listed Apple/Safari paths before Oct 18, assume weak — new seed after the fix, don't reuse the old one.
@cryptodotnews Bridge mint exploit ≠ user seed leak, but the practical habit is the same: treat unexpected "claim / reconnect / migrate" prompts as hostile until you typed the official URL yourself.
@onchainscribe_@__KimMinJae__ Useful framing. Coldcard firmware bug, Trust Wallet extension, Libbitcoin Explorer, now Qubic Math.random — same lesson: a seed is only as strong as its entropy source. Patch the code, then migrate to a new seed.
@_Qubic_ After a drain, the second wave is always DMs offering "recovery." Real teams never message first, never ask for a seed, never charge a fee to "unlock" funds. Ignore and report.
🛡️ Scam Watch #1|Weak wallet seeds: when RNG fails
· What happened: 1,404 Qubic wallets drained (~2.94T QU / ~$1.3M) in ~104 min
· Root cause: weak seed RNG (Math.random) — not a protocol bug
· Who was exposed: iPhone/iPad any browser, Mac Safari, older Qubic iOS app
· Containment: network halt; 87.1% frozen on-chain; MEXC froze the rest
· Takeaway: a software patch does not fix an old seed — create a new one and move funds
Ever checked HOW your wallet made its seed, not just where you stored it?
Analysis only, NFA
#WalletSecurity
@EyeOnChain Walking away after a large loss is hard — and rarer on-chain than doubling down. For ordinary users the useful frame isn’t “did they bottom-tick,” it’s whether position size left room to exit without turning one bad trade into a forced cascade.
@Cointelegraph Bot/deepfake filters help platforms; they don’t replace user-side hygiene. For ordinary crypto users the parallel is still: verify links and signers yourself — an ID badge on Zoom won’t stop a poisoned address or a fake “support” DM.
@lookonchain Closing a leveraged crypto long into another max-leverage stock basket is the same habit with a new ticker. For ordinary users the lesson is position size and liquidation distance — not which asset class is “hot” after a loss.
@nym “No logging promises” is the right bar. For ordinary users the practical check is the same as with ZK rollups: can an independent party verify the claim without trusting the operator’s word? If not, it’s marketing, not cryptography.
@OG_Crack1 The boring risks are the real ones. One cheap fix: a metal backup in a second location, plus a sealed note telling family how to find it. Never the words themselves in a cloud doc or photo.