What happened
The weakness that let an attacker drain 1,404 Qubic wallets wasn’t in the Qubic protocol itself. It was in how some wallets generated their secret seeds on Apple devices, a randomness problem that let the attacker predict private keys rather than break any cryptographic primitive. Qubic’s validators responded by halting the entire network’s consensus to freeze the stolen tokens in place, a step that stopped most of the funds from moving but didn’t return them to their owners.
Key Takeaways
- An attacker drained about 2.94 trillion QU from 1,404 wallets between Oct. 17 and 18, according to Qubic’s update as reported by CryptoPotato.
- Qubic says the cause was weak wallet-seed generation on specific Apple platforms and its old iOS app, not a flaw in the protocol.
- Validators, called Computors, halted the network at tick 85,371,949, freezing 87.1% of the stolen funds on-chain; the remaining 12.9% reached MEXC, which froze the receiving account within about an hour.
- Qubic shipped version 4.26.4, replacing Math.random() with crypto.getRandomValues() for new wallet seeds, but the fix doesn’t recover funds already taken.
- A decision on whether and how to restore the frozen funds now rests with Qubic’s Computor quorum, with no date set for a full network restart.
The mechanism: predictable seeds, not a broken protocol
Qubic traced the breach to insufficient randomness in the process that generates a wallet’s seed, the secret data a wallet uses to derive its keys, according to CryptoPotato. The affected seeds came from three sources: wallets created on iPhones and iPads using any browser before Oct. 18, wallets created on Macs using Safari before that date, and wallets created through the Qubic iOS app before July 2025.
TokenPost reports the underlying code used Math.random() to generate new wallet seeds, a function not designed for cryptographic use because its output can be predictable. Qubic’s fix, shipped in version 4.26.4, switches that code to crypto.getRandomValues(), a browser API built for generating cryptographically secure random values. The change prevents new weak seeds from being created, but it is forward-looking only: it does nothing for wallets whose seeds were already generated under the flawed system and potentially exposed.
The response: halting consensus to freeze the funds
Once the drain was detected, Qubic’s validators, known as Computors, coordinated a network halt at tick 85,371,949 to stop the stolen funds from moving any further, according to CryptoPotato and TokenPost. That action immobilized 87.1% of the roughly 2.94 trillion QU taken from the 1,404 wallets, keeping it on the network rather than letting it reach an exchange or be converted.
The remaining 12.9% had already left the network before the halt, landing on the exchange MEXC. MEXC suspended the receiving account within about an hour of being notified, and the exchange, along with others, has suspended QUBIC deposits and withdrawals at Qubic’s request, per both outlets. TokenPost notes the attack itself ran over a tight window, roughly 23:42 UTC on Oct. 17 to 01:26 UTC on Oct. 18.
Freezing the tokens is not the same as returning them. TokenPost is explicit on this point: the halt immobilized funds still on Qubic but did not restore them to their original owners. That decision sits with the Computor quorum, Qubic’s validator-based governance mechanism, which will determine under the network’s own rules what happens next. BeInCrypto’s coverage frames the episode around the same distinction: an attacker emptied over 1,400 wallets without breaking the underlying blockchain, underscoring that this was a client-side key-generation failure rather than a consensus or smart-contract exploit.
Where the incident fits
Qubic’s Core team is now working to identify every affected identity and prepare options for the quorum to vote on, while a community poll gathers feedback on Discord, according to CryptoPotato. Qubic has urged affected users to report the incident to local police or cybercrime authorities, providing their wallet ID, the amount lost and the relevant transaction link from the Qubic explorer.
The breach lands during a rough stretch for crypto security broadly. PeckShield counted 55 major hacks across the industry in September, with losses near $766.5 million, a 462% jump from August’s $136.3 million, per CryptoPotato’s reporting. Two incidents drove most of that total: the roughly $387 million Bitget breach, which CEO Gracy Chen said involved an attacker manipulating backend transaction data to bypass authorization checks, and the roughly $320 million Liquid Network theft of about 4,000 BTC from a federation wallet, of which $285 million was later recovered after the attacker said they would return funds once nodes were patched. Ledger CTO Charles Guillemet questioned whether that attacker was acting as a legitimate security researcher.
What to Watch
The immediate open question is how Qubic’s Computor quorum rules on the frozen 87.1% of stolen funds, a decision for which no timeline has been published. Equally unresolved is when the network resumes normal operation: TokenPost reports no date has been set for a full restart following the tick 85,371,949 halt. Exchanges including MEXC are still holding QUBIC deposits and withdrawals suspended, so any resumption of trading activity will likely follow, not precede, the quorum’s decision on affected wallets.
