Qubic Freezes Its Network After Weak Wallet Seeds Expose 1,404 Accounts

Qubic froze its network after an attacker drained 1,404 wallets by exploiting weakly generated wallet seeds, turning a software-randomness failure into a roughly $1.3 million security incident.

The attack moved about 2.94 trillion QU between 23:42 UTC on October 17 and 01:26 UTC on October 18. The important distinction is that Qubic says the attacker did not break the blockchain protocol itself.

The exposed point was the process some wallets used to create the secret seed controlling the account.

Cointelegraph reported that the affected group included seeds created in any browser on an iPhone or iPad before October 18, seeds created in Safari on a Mac before that date, and seeds generated through the Qubic iOS app before July 2025.

The report put the drain at roughly $1.4 million across more than 1,400 accounts. It said Qubic halted the chain at tick 85,371,949 while the incident was investigated.

The failure was traced to predictable seeds produced with insufficient randomness rather than a defect in the network’s underlying consensus. Qubic then corrected the seed generator in the latest web-wallet release.

Most of the stolen QU remained immobilized on the paused network. The portion that reached MEXC was also frozen, limiting the attacker’s ability to sell or move it through that exchange.

Cointelegraph also noted that weak randomness has hurt other wallet software before, including past problems tied to Trust Wallet’s browser extension and Libbitcoin Explorer. The recurring pattern matters because a mathematically strong blockchain cannot rescue credentials that were predictable at the moment of creation.

One weak seed can defeat everything built around it.

A wallet seed is supposed to be effectively impossible to predict. If the software generating it does not draw from enough randomness, the final seed may look complicated while still belonging to a much smaller set an attacker can search.

That appears to be the core of this incident. The attacker did not need to reverse the network’s consensus or crack modern cryptography.

Weak seed generation created a shortcut to the private credentials protecting individual wallets.

Security incident update.

Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.

Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ

— Qubic (@_Qubic_) October 18, 2026

Qubic said it corrected seed generation in version 4.26.4. That closes the identified creation flaw for new seeds, but it does not magically strengthen a weak seed that already exists.

Anyone whose wallet falls inside the affected device and date ranges has to treat the old credential as compromised until the project provides a safe migration path.

The emergency halt contained most of the stolen QU.

Qubic’s Computors coordinated a protective halt at tick 85,371,949, stopping transactions while the team traced the drain. According to the project’s incident update, 87.1% of the stolen tokens never left the Qubic network and remained frozen there.

The other 12.9% reached MEXC. Qubic said the exchange froze the receiving account within about an hour, while exchanges were notified and QUBIC deposits and withdrawals were suspended.

87.1% of the drained funds never left the Qubic network and remain frozen in place.

The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour.

Exchanges have been notified and have suspended QUBIC deposits and withdrawals.

— Qubic (@_Qubic_) October 18, 2026

That containment is significant, but frozen is not the same as returned. The network still has to decide what happens to the immobilized balances and how affected users will be treated.

Recovery now moves from code to governance.

Qubic said the Computor quorum will decide the next steps under the network’s rules. The core team is identifying affected identities and preparing options, while a full technical report is expected after the recovery plan is settled.

The incident leaves two separate tests. The first is technical: safely restart the network without reopening the attack path.

The second is institutional: decide whether and how victims are made whole without improvising rules after the fact.

For the broader crypto market, the lesson is uncomfortable but familiar. A chain can work exactly as designed while a wallet implementation fails at the point where users create their keys.

Security is only as strong as the weakest piece between the protocol and the person holding the seed.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.