Qubic has suspended its blockchain operations after an attacker exploited weakly generated wallet recovery seeds to steal approximately $1.4 million in cryptocurrency. The security breach affected 1,404 wallets and resulted in the theft of nearly 2.94 trillion Qubic (QU) tokens.

Recovery seeds serve as the master credential from which a crypto wallet derives its keys, which is why weak randomness at generation time can make those credentials predictable to an attacker.

The network halted transactions on October 18, 2026, in an effort to prevent any further movement of the stolen assets. According to Qubic, 87.1% of the stolen funds remain frozen on its own blockchain, while cryptocurrency exchange MEXC has secured the remaining 12.9%.

Weak Wallet Seeds Identified as Root Cause

Qubic traced the incident to insufficient randomness in its wallet seed generation process. The flaw enabled the attacker to predict certain wallet credentials and gain unauthorized access to user funds.

The project's investigation found that the problem was confined to wallets created through specific Apple devices and applications. Wallets generated through iPhone and iPad browsers before October 18, 2026, were exposed, as were those created by Safari users on Mac computers. Older versions of Qubic's iOS application also carried the vulnerability. Because the exposure is defined by platform and creation date, users can gauge their own risk based on where and when their wallets were generated.

The team emphasized that the weakness originated in wallet seed generation rather than in the blockchain's underlying protocol. The development team addressed the issue in wallet software version 4.26.4, which replaced the insecure random-number generation method with a cryptographically secure alternative. The patched software secures newly created wallets, while the recovery measures now under review apply to the wallets generated before the fix.

MEXC Freezes Remaining Stolen Funds

Following the attack, Qubic coordinated an emergency shutdown of the network at tick 85,37,949, the checkpoint marking exactly where the ledger stopped. The suspension halted all further transactions and restricted the attacker's ability to transfer the stolen assets — a containment step that pauses all user activity, not only the attacker's.

Approximately 2.56 trillion QU tokens remain frozen within the Qubic network. In the meantime, the attacker moved roughly 379 billion QU tokens to MEXC before the exchange froze the receiving account, a restriction the platform reportedly imposed within approximately one hour. That transfer corresponds to the 12.9% share now under MEXC's control, while the other 2.56 trillion QU never left Qubic's chain.

The coordinated response has contained the reported stolen funds, although their eventual recovery remains uncertain.

Validator Vote Will Determine Recovery Plan

Qubic's network validators, known as Computors, will decide the next steps through a governance vote. The development team is reviewing the affected wallets and preparing potential recovery measures for consideration.

Qubic has not announced a confirmed timeline for restoring normal blockchain operations. The project also plans to publish a comprehensive technical report once it has finalized its recovery strategy. The signals to watch from here are the outcome of the Computor vote, any announcement on when the chain resumes, and the planned technical report.

The incident highlights the security risks associated with predictable cryptocurrency wallet seeds. Even when blockchain infrastructure remains intact, weaknesses in wallet software can expose users to substantial financial losses.