Qubic Halts Layer-1 Chain After $1.4M Wallet Seed Theft
In this article5 sections
Qubic stopped its layer-1 blockchain at tick 85,371,949 after an attacker emptied 1,404 wallets of roughly 2.94 trillion QU, valued at about $1.4 million, according to Coincentral. The project said the breach came from weak wallet recovery seeds, not from a flaw in the chain itself, and the network remains paused.
Qubic’s core team placed the unauthorized transfers between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18, a window of under two hours. Coincentral reported that about 87.1% of the stolen tokens, or roughly 2.56 trillion QU, never left the network and are held in place by the shutdown.
Key facts
- The attacker drained 1,404 wallets of approximately 2.94 trillion QU between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18.
- Qubic suspended its blockchain at tick 85,371,949 and has not announced a restart date.
- About 2.56 trillion QU (87.1%) stayed on the network; the remaining 379.26 billion QU reached MEXC, which froze the receiving account within about an hour.
- Affected seeds were created in any browser on iPhone or iPad, in Safari on Mac before Oct. 18, 2026, and in the Qubic iOS app before July 2025.
- Developers fixed the flaw in web wallet version 4.26.4 by replacing JavaScript’s Math.random() with crypto.getRandomValues().
How the seeds failed
Recovery seeds derive the private keys that control a wallet. When a seed is produced with too little randomness, an attacker can reconstruct a smaller set of likely seeds and test them against wallets holding funds, reaching an account without ever obtaining its phrase from the owner.
Qubic traced the problem to its own wallet software. The patch in version 4.26.4 swapped out a general-purpose JavaScript random function for a cryptographic one, a change that applies to newly generated seeds only. The project has not established that phrases created under the older software are safe. News.bitcoin reported that developers also moved additional vulnerable funds before the attacker could reach them, and that QEARN stakes were reportedly unaffected.
Frozen funds and exchange freezes
Because the chain was stopped while most tokens were still on it, the thief cannot move the bulk of the haul. MEXC suspended QUBIC deposits and withdrawals at the project’s request after restricting the receiving account. Crypto.news reported that XT paused similar services on Oct. 18 citing wallet upgrades, covering deposit and withdrawal services on both the QUBIC and KASPLEX networks, while News.bitcoin reported that Bitget suspended QUBIC deposits and withdrawals for maintenance.
Qubic has not confirmed that any tokens have been returned to their owners. Its Computors, the validators who take part in consensus, will vote on how the frozen funds are handled. The project has not said whether that means reversing transfers, distributing frozen tokens another way, or compensating users separately, and no plan has been approved.
Why it matters
The incident puts a familiar failure mode back on display: the weak link was random-number generation in wallet software, the same class of error that hit Coldcard in July 2026, when attackers took about 594 BTC worth $38 million from roughly 500 wallets, and earlier struck Libbitcoin Explorer, where losses topped $900,000, and Trust Wallet, which reported about $170,000. AMLBot’s 2026 report, cited by Coincentral, found hacks made up 19% of third-quarter crypto crime cases but 40% of reported losses. The financial cost here is smaller, yet the damage is concentrated on users who did nothing more than create a wallet on an Apple device. Qubic’s market value stood at about $62.6 million, according to CoinGecko. The reports also differ on valuation: Coincentral and crypto.news put the stolen tokens at about $1.4 million, while News.bitcoin cited $1.3 million.
What to watch
The next marker is the Computors’ vote on a recovery plan, which will determine whether victims see their QU again. Qubic has said it will publish a full technical report once that plan is settled, and it has not set a date for resuming the chain.
Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.
Sources: CoinCentral, News.bitcoin, Crypto.news
