✓ Verified by 2+ outlets
Qubic halts its blockchain after an attacker drains about 1,400 wallets created with weak seeds
Summary
Layer-1 network Qubic halted its chain at tick 85,371,949 after an attacker drained about 2.94 trillion QU from more than 1,400 wallets, Cointelegraph and Crypto Briefing reported, citing the project; Crypto Briefing put the count at 1,404 wallets.
Qubic said the flaw was in how wallet seeds were generated, not in the network’s code, affecting seeds made in any browser on an iPhone or iPad, in Safari on a Mac until Oct. 18, 2026, or in the Qubic iOS app before July 2025, according to Cointelegraph.
Qubic said 87.1% of the drained funds never left the network and remain frozen, while the other 12.9% went to MEXC, which froze the receiving account within about an hour, both outlets reported.
Qubic’s Computors, the operators who run the network, are to vote on recovery options for the frozen funds, and no restart date has been announced, Cointelegraph said.
Outlets differ on the dollar figure: Cointelegraph said about $1.4 million was taken, while Crypto Briefing put it at about $1.3 million at the time.
Key facts
- Crypto Briefing said the attack ran from 23:42 UTC on Oct. 17 to 01:26 UTC on Oct. 18, about 1 hour and 44 minutes, before validators stopped the chain.
- Cointelegraph said a GitHub commit for Qubic web wallet version 4.26.4 replaced JavaScript’s Math.random() with the cryptographically secure crypto.getRandomValues() when creating wallet seeds.
- Crypto Briefing said Bitget suspended QUBIC deposits and withdrawals, that Qubic’s QEARN staking feature was not affected, and that developers said they also secured other funds exposed to the same flaw before they could be taken.
- Cointelegraph said Qubic plans to publish a full technical report once a recovery plan is settled, and that QU had a market capitalization of about $62.6 million per CoinGecko at the time of its report.
- Crypto Briefing said affected users are being told to file police reports, and that this is the second incident in 2026 involving a component adjacent to Qubic’s core, after the Vottun Bridge exploit in August.