Layer-1 blockchain network Qubic halted operations Sunday after an attacker reportedly exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts, according to the project.
In a statement on X, Qubic said the network was halted at tick 85,371,949, where it remains paused at the time of writing. Qubic said the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025, leading to 2.94 trillion Qubit (QU) stolen.
“87.1% of the drained funds never left the Qubic network and remain frozen in place,” said Qubic. “The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour.”
The Qubic theft is the latest in a series of attacks tied to weak wallet seeds. In July, Coldcard disclosed that attackers had stolen funds from wallets whose seeds were weakened by a firmware bug. Similar flaws affected Trust Wallet’s browser extension and the Libbitcoin Explorer tool in 2023.
Related: Bitget’s $388M hack pushes Q3 crypto security losses past $1B
Qubic said it has fixed the seed-generation flaw in the latest version of its web wallet.
A GitHub commit for version 4.26.4 shows that Qubic replaced JavaScript’s Math.random() function, which is not suitable for generating cryptographic secrets, with the cryptographically secure crypto.getRandomValues() function when creating wallet seeds.
Qubic said its core team is identifying affected wallets and preparing recovery options for a vote by the network’s Computors, which will decide what happens to the frozen funds. The team said it would publish a full technical report after a recovery plan is settled. It has not announced when the network will restart.
Qubic did not immediately respond to Cointelegraph’s request for comment.
Qubic is a layer-1 blockchain that supports transactions and smart contracts without fees. It is built on Useful Proof of Work (UPoW) – a consensus mechanism that repurposes mining energy to train artificial intelligence. Qubic’s token had a market capitalization of about $62.6 million at the time of writing, according to CoinGecko.
In the third quarter, hacks and exploits accounted for 19% of crypto crime cases but 40% of reported losses, according to AMLBot’s 2026 investigations report, which looked at 250 investigations it opened since the start of the year.
Magazine: Richard Heart caught ‘off-guard,’ QDay gets even closer: Hodler’s Digest
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.