TLDR Qubic paused its layer-1 blockchain after an attacker stole about $1.4 million in tokens from more than 1,400 wallets. The attacker exploited wallet recovery seeds that had been created
Qubic has stopped its layer-1 blockchain after an attacker drained about $1.4 million in tokens from more than 1,400 wallets. The project said around 2.94 trillion Qubic tokens were taken.
The network was halted at tick 85,371,949 on Sunday, Oct. 18. It remained paused on Monday.
According to the Qubic core team, the attacker targeted wallets whose recovery seeds were created with weak randomness. This made the private keys easier to work out.
Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ
— Qubic (@_Qubic_) October 18, 2026
Qubic said 87.1% of the stolen funds never left its network and are now frozen in place. That equals about 2.56 trillion tokens.
The other 12.9%, or about 379.26 billion tokens, was sent to the crypto exchange MEXC. The project said MEXC froze the receiving account within about an hour.
MEXC then paused Qubic deposits and withdrawals at the project’s request. Exchange XT also suspended deposits and withdrawals on the Qubic and Kasplex networks on Oct. 18, citing wallet upgrades and maintenance.
Qubic has not confirmed that any stolen tokens have been returned to their owners. The project also has not said how recovery would work.
The problem came from Qubic’s wallet software, not the blockchain itself. Recovery seeds are used to create the private keys that control crypto holdings.
Affected wallets include seeds made with any browser on an iPhone or iPad before Oct. 18, 2026. Seeds made with Safari on a Mac before that date were also affected, along with seeds from the Qubic iOS app before July 2025.
Developers fixed the flaw in web wallet version 4.26.4. A GitHub update shows the team replaced JavaScript’s Math.random() function with crypto.getRandomValues(), which is built to create secure random values.
The fix covers new wallet seeds. Qubic has not said that recovery phrases made with the older software are safe.
The attack follows other cases tied to weak wallet seeds. In July 2026, attackers stole about 594 Bitcoin worth $38 million from around 500 Coldcard wallets due to a firmware bug.
In 2023, similar flaws hit Trust Wallet’s browser extension and the Libbitcoin Explorer tool. The Libbitcoin issue, known as Milk Sad, was linked to more than $900,000 in stolen Bitcoin.
Qubic is a layer-1 blockchain that supports transactions and smart contracts without fees. It uses Useful Proof of Work, which directs mining power toward training artificial intelligence.
The project’s token had a market value of about $62.6 million, according to CoinGecko.
According to AMLBot’s 2026 investigations report, hacks and exploits made up 19% of crypto crime cases in the third quarter. However, they accounted for 40% of reported losses.
The core team is now identifying affected wallets and preparing recovery options. The network’s operators, known as Computors, will vote on what happens to the frozen funds.
No recovery plan has been approved yet. Qubic said it will release a full technical report once a plan is settled, and it has not announced when the network will restart.
The post Qubic Halts Blockchain After $1.4 Million Hack Drains 1,400 Wallets appeared first on Blockonomi.
