Attackers stole 2.94 trillion QU from 1,404 wallets in 104 minutes. Weak seed generation exposed wallet credentials, not Qubic’s consensus protocol. Qubic and MEXC have immobilized the report
Qubic’s response to a wallet-security breach has contained the movement of approximately 2.94 trillion QU, but the Layer 1 network now faces a more difficult decision: how to return stolen assets without compromising the integrity of its transaction records.
According to Qubic’s incident disclosure, an attacker compromised 1,404 wallets between 23:42 UTC on October 17 and 01:26 UTC on October 18, 2026. The attacker exploited insufficient randomness in certain wallet seeds, allowing private credentials to be reconstructed.
Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next. https://t.co/7aPJ26lEeZ
— Qubic (@_Qubic_) October 18, 2026
Qubic halted transactions at tick 85,371,949. It reported that 87.1% of the stolen tokens remained on the network, while the other 12.9% had reached MEXC, where the receiving account was frozen.
The distinction between stopping stolen funds and returning them matters. Although the reported balances have been immobilized, their rightful owners have not necessarily regained control.
Qubic attributed the incident to wallet generation rather than a vulnerability in the blockchain’s consensus mechanism.
When a cryptocurrency wallet is created, its software generates a secret seed from which the private key and public address are derived. That seed must be sufficiently unpredictable to prevent another person from discovering it.
If the software draws from too few possible values, an attacker may be able to reproduce candidate seeds, calculate the corresponding wallet addresses and identify those holding cryptocurrency.
Once the correct private key is reconstructed, the attacker can sign transactions that appear technically valid to the network.
This explains why the distinction between a wallet vulnerability and a protocol exploit is significant. The blockchain does not need to malfunction for stolen funds to move. Its transaction-validation rules may operate exactly as designed while accepting a signature produced with compromised credentials.
Qubic’s developer documentation describes the relationship between seeds, private keys and Qubic IDs.
However, the incident disclosure does not establish precisely how the affected seed generator produced insufficient randomness. Without a verified code-level explanation, attributing the weakness to a particular JavaScript function or operating-system random-number source would be speculative.
Qubic identified potentially affected environments including seeds generated through iPhone or iPad browsers before October 18, Mac Safari before that date, and older Qubic iOS applications before July 2025.
The date and method of seed creation are therefore more important than the device currently used to access a wallet.
Qubic’s reported figures provide an unusually clear picture of where the stolen assets were stopped.
Qubic Security Incident Where the Stolen QU Was Frozen Reported distribution following the October 17–18 wallet compromise Total stolen 2.94 trillion QU 87.1% on Qubic 12.9% at MEXC Remaining on Qubic 87.1% ≈ 2.56 trillion QU Immobilized following the network transaction halt. Transferred to MEXC 12.9% ≈ 379.26 billion QU Held in an exchange account that MEXC has frozen. Source: Qubic incident disclosure. Values calculated from reported percentages and rounded totals. Frozen funds have not been confirmed as returned to victims.Amounts are calculated from Qubic’s rounded incident figures and should not be treated as exact wallet balances.The two groups of assets face different recovery challenges.
Tokens remaining on Qubic are subject to the network’s transaction halt and any subsequent decision by its Computor quorum. The funds at MEXC are controlled through the exchange’s custodial infrastructure, making their release dependent on its procedures and any applicable legal requirements.
Exchange cooperation can prevent further withdrawals, but it does not by itself determine who should receive the assets. The exchange may need evidence linking the deposit to the theft and documentation establishing the victims’ ownership.
Meanwhile, Qubic’s network halt restricts legitimate activity alongside malicious transfers. Other exchanges also suspended QUBIC deposits and withdrawals, extending the disruption beyond the compromised wallets.
A freeze therefore reduces the attacker’s immediate ability to move funds, but it also imposes costs on unaffected holders who cannot transact normally.
Qubic uses a consensus system involving 676 Computors. Its technical documentation describes a quorum of at least 451 Computors for agreement on computation results.
The project’s incident update assigns the recovery decision to the Computor quorum under Qubic’s rules. It has not yet established a completed restitution process.
The challenge is not simply identifying where the tokens went. Qubic must determine how affected holders can regain control of their assets, what evidence establishes ownership and how the network can resume without exposing other weak wallets.
A restart before vulnerable holders have an opportunity to migrate could create another window for theft. Conversely, an extended halt prevents unaffected users from accessing normal network services.
There is also a distinction between consensus agreement and the authority to alter historical balances. The project’s standard quorum threshold does not, by itself, establish the voting requirements or technical procedure for restitution.
A community poll is expected to inform the decision, with a full technical report planned after the recovery approach is settled.
Qubic says the seed-generation weakness has been corrected in version 4.26.4. The patch does not change private keys derived from previously generated seeds.
For holders, the appropriate response depends on how their original credentials were created.
The community incident resource warns that additional weak wallets may exist beyond those already drained. That makes credential migration relevant even for holders whose balances were not stolen.
Qubic’s immediate response has prevented the reported stolen tokens from moving further.
Whether holders recover their balances remains unresolved, as does the timetable for restoring unrestricted network activity.
The next substantive developments will be the Computor quorum’s recovery decision, confirmed migration procedures and the promised technical report explaining how the vulnerable seeds were generated.
The post Qubic Hack Exposes 1,404 Wallets as 2.94 Trillion QU Is Stolen appeared first on ETHNews.
