Qubic halted its blockchain after an attacker exploited predictably generated wallet seeds to drain 1,404 accounts of approximately 2.94 trillion QU, worth around $1.3 million at the time. The incident originated in wallet key generation rather than a vulnerability in Qubic’s consensus protocol or smart-contract execution, prompting validators to stop transaction processing while most of the stolen assets were still on the network.

According to Qubic’s October 18 security disclosure, the unauthorized transfers occurred between 23:42 UTC on October 17 and 01:26 UTC on October 18. Computors subsequently coordinated a protective halt at tick 85,371,949. The pause immobilized approximately 87.1% of the drained QU that remained in attacker-controlled addresses on Qubic, while another 12.9%, roughly 379 billion QU, had already reached MEXC.

Qubic said MEXC froze the receiving account about an hour after the deposit. A freeze prevents further movement but does not mean those assets have already been returned to affected holders, and the same distinction applies to the tokens trapped by the network halt.

Security incident update.

Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.

Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ

— Qubic (@_Qubic_) October 18, 2026

Weak Randomness Exposed Wallet Seeds

Qubic traced the incident to insufficient randomness when certain wallet seeds were generated. The affected environments include seeds created through any browser on an iPhone or iPad before October 18, Safari on macOS before that date, and the Qubic iOS application before July 2025. The relevant risk depends on where and when the seed was originally created, not which device is currently being used to access the wallet.

Code associated with wallet version 4.26.4 replaces JavaScript’s Math.random() with the cryptographically secure crypto.getRandomValues() mechanism. The revised implementation also stops seed creation if that secure source is unavailable. Updating the generator prevents the same weakness from affecting newly created wallets, but it cannot add entropy retroactively to an already predictable seed.

The failure resembles a recent Coldcard incident in which weakened seed randomness allowed private keys to be reconstructed offline. In both cases, the security boundary failed during secret generation rather than through a compromise of blockchain consensus. A transaction signed with a reconstructed private key can remain cryptographically valid even though the legitimate holder never authorized it.

Other wallet incidents demonstrate different versions of the same broader distinction. A Trust Wallet browser-extension compromise exposed user funds through compromised client software, while recent Ledger hardware tampering targeted recovery phrases before normal wallet operation. Wallet security therefore depends on the integrity of seed generation, software distribution and hardware provenance in addition to the underlying blockchain.

Recovery Now Depends on Qubic Governance

Qubic’s core team is compiling the affected-wallet inventory and preparing recovery options for consideration by the Computors. Any redistribution, restoration or other on-chain remedy requires a separate governance decision and should not be assumed from the fact that most stolen tokens are currently immobilized.

The network also remained paused on October 19, with public infrastructure still reporting tick 85,371,949. That containment measure stopped the attacker from moving additional on-chain balances, but it also prevented ordinary users from processing legitimate transactions. Stopping a blockchain can contain an active security incident while simultaneously creating an availability cost for every participant on the network.

Qubic has additionally warned users about recovery scams, stating that team members will not request seeds or charge fees to restore funds. For potentially affected holders, the critical distinction is that a patched wallet application does not make an old weak seed safe again.

The incident therefore combines two separate recovery problems: repairing the client software and deciding what happens to the already compromised balances. Version 4.26.4 addresses the first problem, while the Computor vote, network restart and eventual treatment of frozen funds will determine whether Qubic can resolve the second.