TLDR
- Qubic paused its layer-1 blockchain on Sunday after an attacker drained about $1.4 million from more than 1,400 wallets.
- The theft was tied to weak wallet seeds created on iPhones, iPads, Safari on Mac and an older Qubic iOS app.
- About 87.1% of the stolen funds remain frozen on the network, and MEXC froze the account that received the rest.
- Developers fixed the flaw in web wallet version 4.26.4, but older seeds may still be at risk.
- Computors will vote on a recovery plan, and no restart date has been announced.
Qubic halted its layer-1 blockchain on Sunday after an attacker drained about $1.4 million from more than 1,400 wallets. The project said the theft was tied to weakly generated wallet seeds.
The network stopped at tick 85,371,949, according to a statement on X. Qubic said it remains paused.
Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ
— Qubic (@_Qubic_) October 18, 2026
About 2.94 trillion Qubic tokens were stolen. The attacker targeted wallets whose recovery seeds were created with too little randomness.
How the wallet flaw worked
Weak randomness can make private keys easier to guess. An attacker can then reach a wallet without getting the recovery phrase from its owner.
Qubic said affected seeds were created in any browser on an iPhone or iPad. Seeds made in Safari on a Mac before Oct. 18, 2026, were also hit.
Seeds made in the Qubic iOS app before July 2025 were affected as well. The project said the problem came from its wallet software and not from the blockchain protocol.
Developers fixed the flaw in web wallet version 4.26.4. The update replaced JavaScript’s Math.random() function with crypto.getRandomValues(), which is built for cryptographic use.
Qubic has not said whether older seeds are safe. Its fix covers only new wallet seeds.
Frozen funds and recovery
Qubic said 87.1% of the stolen funds never left the network. That is about 2.56 trillion tokens.
The other 12.9%, or 379.26 billion tokens, went to exchange MEXC. The exchange froze the receiving account within about an hour.
MEXC also suspended deposits and withdrawals for Qubic at the project’s request. Exchange XT paused similar services on Oct. 18, citing wallet upgrades.
The core team is identifying affected wallets and preparing recovery options. Computors, the network’s validators, will vote on what happens to the frozen funds.
Qubic has not said if recovery would reverse transfers or compensate users another way. It has not confirmed that any tokens were returned.
The attack follows other seed flaws. In July, Coldcard said attackers stole about 594 BTC, worth $38 million, from around 500 wallets.
Libbitcoin Explorer and Trust Wallet had similar problems in 2023. Libbitcoin losses topped $900,000, while Trust Wallet reported about $170,000.
AMLBot’s 2026 report found hacks made up 19% of third quarter crypto crime cases but 40% of reported losses.
Qubic’s market value was about $62.6 million, according to CoinGecko. The project plans a full technical report after a recovery plan is settled, and it has not announced a restart date.
Be the first to comment