Qubic has halted its layer-1 blockchain after an attacker drained roughly $1.4 million in tokens from more than 1,400 user wallets, exploiting recovery seeds that had been generated with weak randomness.

The network was stopped at tick 85,371,949 on Sunday, Oct. 18, and remained paused as of Monday. The project said approximately 2.94 trillion Qubic tokens (QU) were taken in the attack.

Weak Randomness Exposed Private Keys

According to the Qubic core team, the attacker targeted wallets whose recovery seeds had been created with insufficient randomness, making the corresponding private keys easier to work out. The weaker the randomness, the smaller the space of possible keys an attacker needs to search. The thefts took place between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18.

Security incident update. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ — Qubic (@Qubic) October 18, 2026

Most Stolen Funds Remain Frozen

Qubic said 87.1% of the stolen funds — about 2.56 trillion tokens — never left its network and have been frozen in place. The remaining 12.9%, roughly 379.26 billion tokens, was sent to the crypto exchange MEXC. The project said MEXC froze the receiving account within about an hour, then paused Qubic deposits and withdrawals at the project's request. The split means the bulk of the recovery effort runs Qubic's own network processes, while the exchange-held portion depends on MEXC's controls.

Exchange XT separately suspended deposits and withdrawals on the Qubic and Kasplex networks on Oct. 18, citing wallet upgrades and maintenance.

Qubic has not confirmed that any stolen tokens have been returned to their owners, and it has not yet explained how recovery would work.

The Flaw Sat in Wallet Software, Not the Chain

The vulnerability originated in Qubic's wallet software rather than the blockchain protocol itself. Recovery seeds are used to create the private keys that control crypto holdings. That distinction matters: the protocol itself was not broken, yet individual holdings were still directly at risk.

Affected wallets include those whose seeds were created with any browser on an iPhone or iPad before Oct. 18, 2026. Seeds generated with Safari on a Mac before that date were also affected, as were seeds created through the Qubic iOS app before July 2025.

Developers patched the flaw in web wallet version 4.26.4. A GitHub update shows the team replaced JavaScript's Math.random() function with crypto.getRandomValues(), an interface built to produce cryptographically secure random values. The fix covers new wallet seeds only, and Qubic has not said whether recovery phrases generated with the older software are safe.

A Pattern of Weak-Seed Attacks

The incident follows other cases tied to weak wallet seeds. In July 2026, attackers stole about 594 Bitcoin, worth $38 million, from roughly 500 Coldcard wallets due to a firmware bug. In 2023, similar flaws hit Trust Wallet's browser extension and the Libbitcoin Explorer tool. The Libbitcoin issue, known as Milk Sad, was linked to more than $900,000 in stolen Bitcoin.

According to AMLBot's 2026 investigations report, hacks and exploits accounted for 19% of crypto crime cases in the third quarter, yet they represented 40% of reported losses — a small share of incidents driving an outsized share of the money lost.

About Qubic and What Comes Next

Qubic is a layer-1 blockchain that supports transactions and smart contracts without fees. It uses Useful Proof of Work, a mechanism that directs mining power toward training artificial intelligence. The project's token had a market value of about $62.6 million, according to CoinGecko.

The core team is now identifying affected wallets and preparing recovery options. The network's operators, known as Computors, will vote on what happens to the frozen funds, and no recovery plan has been approved so far. Qubic said it will release a full technical report once a plan is settled, and it has not announced when the network will restart.

Source: Blockonomi