An overnight cryptocurrency theft emptied 1,404 Qubic wallets of approximately 2.94 trillion QU, worth $1.3 million, before validators halted the network. The apparent culprit wasn’t a blockchain vulnerability but predictable wallet seeds generated by older Apple devices and browsers. With most stolen tokens trapped on the paused network and another portion frozen by MEXC, the fate of victims’ funds now rests with Qubic’s validators.
Key Takeaways
- Qubic reported 1,404 wallets drained of approximately 2.94 trillion QU between Oct. 17 and 18.
- Qubic attributed the theft to predictable wallet seeds generated by older Apple software.
- MEXC reportedly froze the stolen tokens it received, while Qubic’s quorum considers restitution.
Qubic Exploit Drains 1,404 Wallets as Network Freezes $1.3 Million Theft
A cryptocurrency thief managed to empty 1,404 Qubic wallets in less than two hours, stealing roughly 2.94 trillion QU worth $1.3 million without hacking the blockchain itself. Instead, the attacker apparently exploited something far simpler: predictable wallet recovery seeds generated by older software. By the time Qubic’s validators intervened early Sunday, Oct. 18, most of the stolen funds were still on the network, while an exchange had frozen another portion, leaving an extraordinary digital heist effectively trapped in place.
Predictable Wallet Seeds Opened the Door
Qubic reported that the unauthorized transfers occurred between 23:42 UTC Saturday and 01:26 UTC Sunday. Computors, the network’s validators, subsequently halted transactions at tick 85,371,949. The vulnerability involved insufficient randomness when generating 55-character wallet seeds. Rather than guessing an astronomical number of possible combinations, the attacker apparently reconstructed a smaller collection of predictable seeds and identified wallets holding funds.
Affected wallets included seeds generated on iPhones and iPads through browsers, Macs running Safari, and older versions of Qubic’s iOS application. Developers said the issue was corrected in version 4.26.4. They also secured additional vulnerable funds before the attacker reached them. Qubic’s native currency is down more than 10% at 10 a.m. Eastern time on Sunday morning.
Most Stolen Tokens Remain Frozen
The attack’s aftermath produced an unexpected complication for the thief. Approximately 87.1% of the stolen QU remained on Qubic, immobilized by the network suspension. The remaining 12.9% reportedly reached cryptocurrency exchange MEXC, which froze the receiving account. QEARN stakes were reportedly unaffected. Bitget subsequently suspended QUBIC deposits and withdrawals for maintenance. Whether victims receive reimbursement now depends on decisions by Qubic’s Computor quorum.
A Network With a Controversial History
Qubic was founded by Sergey Ivancheglo, also known as “Come-from-Beyond,” an early blockchain developer associated with NXT and IOTA. The project attracted controversy in 2025 after claiming majority control of Monero’s mining hashrate, followed by blockchain reorganizations that alarmed the privacy coin’s community.
This time, Qubic wasn’t challenging another network’s security. It was confronting a weakness in its own wallet software, with billions of tokens immobilized and victims awaiting a decision on restitution.