- 1,404 Qubic wallets were drained in under two hours, with approximately 2.94 trillion QU stolen.
- Insufficient randomness made certain wallet seeds more predictable, weakening the security expected from Qubic’s 55-character seed format.
- The flaw was traced to wallet seed generation, not the Qubic protocol itself.
Between 23:42 UTC on October 17 and 01:26 UTC on October 18, an attacker systematically drained 1,404 Qubic wallets totalling approximately 2.94 trillion QU. The attack window was tight, under two hours, but that was enough time to clear out more than a thousand wallets before the network responded.
The vulnerability was not in the QubQUic protocol itself. It was in how certain wallet seeds were generated. Some seeds were created with insufficient randomness, producing a smaller pool of predictable combinations than the 55-character seed format was designed to require.
Moreover, rather than brute-forcing an astronomical number of possibilities, the attacker reconstructed that reduced set of predictable seeds, identified which ones held funds, and drained them.
Which Wallets Are Affected and How the Network Responded?
Seeds are vulnerable if they were created on an iPhone or iPad in any browser before October 18, 2026, on a Mac using Safari before October 18, 2026, or in the Qubic iOS app before July 2025. Also, if the wallet falls into any of these categories, treat it as compromised.
Computors, Qubic’s network validators, coordinated a protective halt at tick 85,371,949, locking the ledger in place. In addition, it is preventing any further transactions from processing. That single decision contained the majority of the damage.
As a result, 87.1% of the drained funds never left the Qubic network and remain frozen on-chain, unable to be moved or sold while the situation is being resolved. The remaining 12.9% was sent to MEXC, whose team froze the receiving account within approximately one hour of the transfer. All exchanges have since suspended QUBIC deposits and withdrawals.
Security Update Deployed
Seed generation has been corrected in version 4.26.4. No new weak seeds can be created from this point forward. Any resolution regarding the frozen funds and affected wallets is a decision for the Computor quorum under the network’s own rules. The Core team is identifying every affected wallet and preparing options for the quorum to consider. A community poll is currently open on Discord to give Computors a clear picture of where the community stands before any decision is made.
What Affected Users Should Do
File a report with police or cybercrime authorities in your country. Include your wallet ID, the amount lost, and the transaction link from Qubic. Besides, a formal report helps keep exchange funds frozen and support any recovery process.
Significantly, nobody from Qubic will ever message first, ask for seed, or offer recovery services for a fee. Upon receiving any such message, report it immediately, and a full technical report will follow once recovery is settled.
Crypto Market Highlights
SUI Faces Fresh Selling Pressure as a 4% Drop Puts Bulls on the Defensive
Be the first to comment