About $1.3 million—1,404 wallets drained in under two hours.
Early on October 18 Beijing time, someone targeted a batch of old wallets with insufficiently random “seed phrases”: recovery phrases generated on older Apple devices, in Safari, or in older apps had weak entropy and could be guessed in advance. Using these predictable seeds, the attacker swept up about 2.94 trillion QU between roughly 7:42 and 9:26 a.m. Beijing time on the 18th—less than two hours’ work, worth about $1.3 million at the time.
The second half was even more dramatic: network validators urgently halted the chain, leaving about 87% of the stolen coins frozen on-chain; the remaining 13% was sent to exchanges, where the receiving accounts were immediately frozen too. So far, the attacker has barely managed to cash out a thing. The protocol itself wasn’t breached—the problem was how wallet seeds were generated. The team has released a patch, while compensation for victims is still awaiting a validator vote.
That’s crypto for you: you think your assets are safe because they’re sitting in your own wallet, but that insufficiently random seed on an old device is the real backdoor. What do you think about this “the chain is fine, but the wallet failed” situation? Come share your thoughts in the comments.
Early on October 18 Beijing time, someone targeted a batch of old wallets with insufficiently random “seed phrases”: recovery phrases generated on older Apple devices, in Safari, or in older apps had weak entropy and could be guessed in advance. Using these predictable seeds, the attacker swept up about 2.94 trillion QU between roughly 7:42 and 9:26 a.m. Beijing time on the 18th—less than two hours’ work, worth about $1.3 million at the time.
The second half was even more dramatic: network validators urgently halted the chain, leaving about 87% of the stolen coins frozen on-chain; the remaining 13% was sent to exchanges, where the receiving accounts were immediately frozen too. So far, the attacker has barely managed to cash out a thing. The protocol itself wasn’t breached—the problem was how wallet seeds were generated. The team has released a patch, while compensation for victims is still awaiting a validator vote.
That’s crypto for you: you think your assets are safe because they’re sitting in your own wallet, but that insufficiently random seed on an old device is the real backdoor. What do you think about this “the chain is fine, but the wallet failed” situation? Come share your thoughts in the comments.