Qubic has suspended its blockchain after an attacker drained 1,404 wallets holding approximately 2.94 trillion QU tokens, valued at around $1.3 million, by exploiting predictable wallet seeds generated through vulnerable software.

The theft took place between 23:42 UTC on October 17 and 01:26 UTC on October 18, 2026. Qubic's Computors coordinated an emergency network halt at tick 85,371,949, stopping further transactions while the development team investigated the affected wallets. The team communicated the shutdown through an official post on X.

Containment efforts largely held. Approximately 87.1% of the stolen tokens remained on the halted network, while the remaining 12.9% reached cryptocurrency exchange MEXC, which froze the receiving account. The funds are now immobilized, though their eventual recovery and distribution remain unresolved.

Weak Wallet Seeds Exposed More Than 1,400 Accounts

The attacker exploited insufficient randomness in wallet recovery-seed generation, leaving resulting private keys vulnerable to prediction. Because a recovery seed serves as the root credential from which a wallet derives its private keys, weakness at the generation stage places every address those keys control at risk. Affected environments include any browser running on an iPhone or iPad before October 18, 2026, Safari on macOS before the same date, and the Qubic iOS application before July 2025.

The flaw sat in wallet seed generation rather than in Qubic's underlying consensus or transaction-validation rules. Addresses created with predictable seeds remained exposed even when their owners had not recently interacted with malicious applications or signed suspicious transactions.

Weak randomness at seed creation is a failure mode that has surfaced across the industry before. The Ill Bloom wallet flaw exposed cryptocurrency addresses through insufficient randomness during recovery phrase creation, while a separate Coldcard vulnerability affected hardware wallets that generated insufficiently secure Bitcoin seeds.

Qubic's affected-wallet records identify 2,939,606,531,944 QU transferred into seven collecting addresses during the incident. Wallets created through the vulnerable environments remain potentially compromised, even when they were not included in the identified thefts.

Qubic Releases Version 4.26.4 to Fix Seed Generation

On October 18, Qubic released wallet version 4.26.4, published on GitHub, introducing a correction to its seed-generation process. The security patch replaces JavaScript's Math.random() function with crypto.getRandomValues(), providing cryptographically secure randomness for newly generated wallet seeds, as detailed in the associated commit. Math.random() is JavaScript's general-purpose pseudorandom generator and is not designed for security-critical use, whereas crypto.getRandomValues() draws from the underlying's cryptographic random source.

The updated implementation also rejects selected random byte values to eliminate statistical bias when converting random data into the 55-character seeds used by Qubic.

The correction protects newly generated seeds but does not secure wallets created with the vulnerable method. Affected users need fresh wallets with securely generated seeds and must transfer any remaining assets once network transactions resume and the team provides migration instructions. Qubic has also warned users against unsolicited recovery offers and requests for wallet seeds or private keys.

Computors to Decide Recovery as Network Remains Frozen

Qubic's emergency response prevented most stolen funds from moving beyond its own network, while MEXC immobilized the exchange-held portion. The Computor cluster will determine the next recovery actions through the network's governance procedures.

The incident came shortly after Cysic's bridge was exploited, allowing an attacker to mint 10 million unauthorized CYS tokens and transfer approximately $727,000 in proceeds to Ethereum before the bridge was suspended.

Qubic is identifying additional potentially exposed addresses and assessing how to protect remaining balances before restoring normal operations. Its QEARN staking system was reported unaffected, although network-level transaction processing remains suspended. Exchanges have also restricted QU transfers while the incident remains unresolved, preventing additional deposits and withdrawals through affected platforms.

Qubic plans to publish a comprehensive technical report after its recovery approach is finalized. The Computor quorum has not announced a final compensation decision or a confirmed date for restarting the network.

Source: Crypto Adventure