Qubic has halted its layer-1 blockchain after an attacker exploited a wallet security flaw to steal approximately 2.94 trillion QU tokens worth $1.4 million from more than 1,400 accounts. Sum
Qubic has halted its layer-1 blockchain after an attacker exploited a wallet security flaw to steal approximately 2.94 trillion QU tokens worth $1.4 million from more than 1,400 accounts.
SummaryAccording to an Oct. 18 statement from the Qubic core team, the attacker targeted wallets whose recovery seeds had been generated with insufficient randomness, leaving their private keys vulnerable to discovery.
Security incident update. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ
— Qubic (@_Qubic_) October 18, 2026
The network was suspended at tick 85,371,949 to prevent further movement of the stolen tokens. Qubic said 87.1% of the stolen funds remained within the network when operations stopped, while the remaining 12.9% had reached cryptocurrency exchange MEXC.
The exchange froze the receiving account within approximately an hour, according to the project.
Qubic has not announced when its blockchain will resume operations, with the recovery of stolen assets awaiting a decision from its network operators, known as Computors.
The attack exploited a flaw in the way certain Qubic wallets generated recovery seeds, which are used to derive the private keys controlling cryptocurrency holdings.
Weak randomness during seed generation can make private keys easier to reconstruct, allowing an attacker to access a wallet without obtaining its recovery phrase directly from the owner.
Qubic identified several categories of affected wallets based on the device, browser and application used when the recovery seed was created.
Wallets generated through any browser on an iPhone or iPad before Oct. 18, 2026, were affected, along with seeds created through Safari on Mac computers before the same date.
The vulnerability extended to seeds generated through the Qubic iOS application before July 2025.
The project said the problem originated in its wallet software and did not involve a compromise of the underlying blockchain protocol.
You might also like: Ledger CEO clashes with ex-Mt. Gox boss over $90M wallet thefts
Developers have since corrected the seed-generation flaw in web wallet version 4.26.4, according to the project’s security update.
The reported change replaced JavaScript’s Math.random() function with crypto.getRandomValues(), which is designed to generate cryptographically secure random values.
JavaScript’s Math.random() is not intended for generating private keys or other cryptographic secrets because its output does not provide the security guarantees required for such operations.
Although the correction addresses the method used to generate new wallet seeds, the project has not established that recovery phrases created under the vulnerable software are secure.
Qubic said it would publish a full technical investigation after its recovery plan had been settled.
The network halt has left most of the stolen tokens frozen while the development team examines the affected wallets and prepares recovery proposals.
Based on Qubic’s reported figures, approximately 2.56 trillion QU remained on the blockchain when transaction processing stopped.
The remaining 379.26 billion QU had been transferred to MEXC, where the receiving account was restricted following contact with the exchange.
MEXC subsequently suspended QUBIC deposits and withdrawals at the project’s request. The restriction prevented customers from moving tokens through the affected network while the incident was being investigated.
Cryptocurrency exchange XT introduced a similar suspension on Oct. 18, citing wallet upgrades and maintenance. The announcement covered deposit and withdrawal services on both the QUBIC and KASPLEX networks.
Although the restrictions prevented transfers through those services, Qubic has not confirmed that any of the stolen tokens have been returned to their original owners.
The core team is identifying compromised wallets and preparing recovery proposals for a vote by the network’s Computors.
Computors participate in Qubic’s consensus process and will decide how the frozen funds should be handled under the proposed recovery arrangements.
The project has not announced whether recovery would involve reversing unauthorized transfers, returning frozen tokens through another mechanism or compensating affected users separately.
No final recovery plan has been approved.
The Qubic exploit follows several cryptocurrency security incidents involving weaknesses in the generation of wallet recovery seeds.
In July 2026, Bitcoin hardware wallet manufacturer Coldcard disclosed a firmware vulnerability that allowed attackers to target wallets whose recovery phrases had been generated using insufficient randomness.
The flaw was traced to a firmware configuration introduced in March 2021, which caused affected devices to use a predictable software random-number generator instead of their intended hardware source.
As crypto.news previously reported, attackers stole approximately 594 BTC worth $38 million from around 500 Coldcard wallets during a 25-minute attack on July 31.
The vulnerability reduced the effective entropy of some wallet seeds from the intended 128 bits to approximately 40 bits, leaving affected private keys exposed to attempts to guess them through repeated calculations.
Coldcard subsequently released updated wallet firmware on Aug. 20, introducing additional safeguards that required users to contribute their own randomness when generating new recovery phrases.
The manufacturer warned that installing updated software would not repair seeds created under vulnerable firmware versions. Affected holders were instructed to generate new wallets and transfer their Bitcoin.
Similar problems had affected other cryptocurrency wallet applications in previous years.
In August 2023, a Libbitcoin Explorer vulnerability was linked to the theft of more than $900,000 from Bitcoin users.
The weakness, known as Milk Sad, involved a faulty key-generation process that allowed attackers to predict private keys associated with certain wallet seeds.
Security researchers found that the bx seed command lacked sufficient randomness, potentially allowing the same recovery seed to be generated more than once.
Trust Wallet disclosed a separate browser extension vulnerability in April 2023 that affected wallet addresses created during a limited period in November 2022.
The company identified two suspected exploits involving approximately $170,000 in losses and announced a reimbursement process for affected users.
Trust Wallet said the issue had been fixed and advised holders of affected addresses to transfer their funds to newly generated wallets.
Qubic’s core team is working to identify the accounts affected by the October attack before submitting recovery proposals to its Computors.
The network operates using Useful Proof of Work, a consensus mechanism designed to direct mining computation toward artificial intelligence workloads. Its blockchain supports smart contracts and transactions without conventional transaction fees.
At the time of the original incident report, Qubic’s market capitalization stood at approximately $62.6 million, according to CoinGecko.
The security incident occurred during a period when hacks and exploits accounted for a substantial portion of reported cryptocurrency losses.
According to AMLBot’s 2026 investigations report, hacks and exploits represented 19% of cryptocurrency crime cases during the third quarter but accounted for 40% of reported financial losses.
The blockchain investigation company based its findings on 250 investigations opened since the beginning of the year.
Qubic said it would publish a full technical report after the recovery plan was settled, while the date for restarting network operations remained unannounced.
Read more: Michael Saylor hints at more Bitcoin buys as Strategy holds 848,250 BTC
