Layer-1 blockchain Qubic suspended network operations after attackers exploited a wallet security vulnerability to drain 1,404 addresses of approximately 2.94 trillion QU tokens during a coordinated attack on October 17–18, 2026.The stolen cryptocurrency was valued at approximately $1.3 million to $1.4 million, depending on the market price used.According to Qubic’s incident disclosures, the unauthorized transfers occurred between 23:42 UTC on October 17 and 01:26 UTC on October 18, lasting one hour and 44 minutes. The project reported that 87.1% of the stolen tokens remained immobilized on its blockchain following an emergency network halt. The remaining 12.9% reached cryptocurrency exchange MEXC, which subsequently froze the receiving account.Although the intervention prevented further movement of the identified funds, their recovery and potential return to affected users remain unresolved.
Weak Wallet Seeds Expose 1,404 Addresses
Qubic attributed the attack to insufficient randomness during wallet seed generation, rather than a vulnerability in the blockchain’s underlying transaction-validation protocol.Wallet seeds are cryptographic secrets used to generate private keys and control cryptocurrency holdings. When generated with inadequate randomness, they may become predictable enough for attackers to reconstruct. The affected seeds were associated with specific Apple-device wallet creation methods.According to the project’s technical disclosures, vulnerable configurations included wallets created before October 18, 2026, using any browser on an iPhone or iPad, as well as wallets generated through Safari on macOS before that date.Seeds created using the Qubic iOS application before July 2025 were also identified as potentially vulnerable. Attackers exploited these weaknesses to access existing wallets and transfer their balances into attacker-controlled addresses. On-chain records compiled by community investigators identified 1,404 drained addresses and approximately 2,939,606,531,944 QU transferred.Qubic subsequently announced that the seed-generation vulnerability had been corrected in wallet software version 4.26.4. However, updating the software does not automatically secure wallets whose original recovery seeds were generated using the vulnerable mechanism.
Network Halt Freezes Funds as Recovery Decision Awaits
Qubic’s network validators, known as Computors, coordinated an emergency suspension at tick 85,371,949 to prevent further movement of stolen assets.Approximately 2.56 trillion QU, representing 87.1% of the stolen amount, remained in attacker-controlled addresses on the suspended blockchain. Another 379.04 billion QU, equivalent to 12.9%, had reached MEXC before the intervention. The exchange froze the associated deposit account.Other exchanges, including Bitget, suspended Qubic deposits and withdrawals as the incident unfolded. The network suspension also prevented legitimate users from conducting ordinary transactions, illustrating the operational consequences of emergency intervention in blockchain systems. Qubic indicated that subsequent decisions concerning the immobilized funds would be determined through its Computor quorum, with community consultation expected to inform the process.Potential recovery measures have not yet been finalized, and freezing assets should not be interpreted as confirmation that victims will receive reimbursement. The incident also raises broader questions about wallet security across cryptocurrency networks. Although blockchain consensus mechanisms can remain uncompromised, weaknesses in wallet software can still expose user funds to theft.For affected Qubic holders, the immediate priority is identifying potentially vulnerable recovery seeds and following verified migration instructions once network operations permit transfers. Qubic has warned users against unsolicited recovery offers and requests to disclose private keys. The project’s next steps will determine whether the immobilized assets can be restored without creating additional risks for network participants.