Wallet keys for Qubic could be recovered from six samples taken from the network, according to a report from security firm SlowMist. The finding points to a flaw in how the wallet generates account seeds, and a newly released patch aims to cut the link between new accounts and the exposed random stream.
The fix, version 4.26.4, changes the way new account seeds are produced. It does not touch header generation, leaving that part of the wallet's output as it was.
What SlowMist found in the samples
SlowMist's report says its researchers were able to pull wallet keys out of six network samples. The samples came from the network itself, which puts the issue closer to the wallet's key-generation path than to any single user's machine. The firm didn't say how the samples were collected or how long the recovery took.
The core problem sits in the random stream the wallet relies on when it builds account seeds. If that stream can be observed or reconstructed, the keys derived from it can be reproduced. SlowMist's finding suggests that's what happened across the six samples it examined.
How the 4.26.4 patch splits the stream
Version 4.26.4 separates new account seeds from the random stream that was exposed. In practice, that means accounts created after the patch won't draw from the same source that SlowMist's samples pointed to. The change is limited to new accounts — the patch notes don't describe any rework of existing seeds.
Header generation stays as it was. That's a deliberate boundary: the patch targets the seed path, not every part of the wallet's output. Whether that's enough to close the exposure depends on details SlowMist hasn't published and the Qubic team hasn't addressed.
The exposure window for existing wallets
Nothing in the report says existing wallets were fixed. The patch covers new account seeds, and header generation is unchanged, so wallets created before 4.26.4 still sit on the old random stream. Users who set up accounts before the update have no stated path to a clean seed unless they generate a new account.
SlowMist hasn't said which six samples it used, whether they came from mainnet or a test environment, or what method turned samples into keys. Those gaps matter. A recovery demonstrated on six samples is a proof of concept, not a count of affected wallets.
What users can do before more details arrive
For now, the concrete step is the update itself. Running 4.26.4 means any new account you create is separated from the random stream SlowMist flagged. It doesn't retroactively protect an older account.
The open question is whether the Qubic team will publish a full write-up of the random stream flaw and a plan for pre-patch wallets. SlowMist's report names the samples and the version number but stops short of a remediation guide. Until that lands, users with older accounts are working from a partial picture.
