Qubic halted its network after attackers exploited weakly generated wallet credentials to remove roughly $1.4 million in cryptocurrency from more than 1,400 accounts, according to the project’s account of the incident.
TL;DR: The reported loss involved 1,404 wallets and around 2.94 trillion QU. The issue was traced to wallet seed generation rather than a confirmed compromise of the blockchain’s consensus rules.
The distinction matters. Users can lose control of coins even when the underlying network continues to process transactions exactly as designed. If the randomness used to create a private key is predictable, attackers may be able to reconstruct the key and sign transfers that appear valid to everyone else on the chain.
Qubic developers linked the weakness to seed generation in a web-wallet environment, with reports pointing to the use of JavaScript’s Math.random function. That function was never intended to supply cryptographically secure entropy for protecting money. Strong randomness, obtained from appropriate operating-system cryptographic interfaces, is essential when generating wallet secrets.
The project responded with an emergency network halt while investigators and validators worked through containment options. Pausing a decentralized system can reduce immediate movement of funds, but it also prevents normal users from transacting and raises difficult questions about authority and any possible rollback.
People holding QU should rely on official security instructions before importing or moving affected wallet credentials. Generating a fresh address using a patched wallet is not the same as safely recovering funds already transferred away.
The incident is a reminder that wallet security begins before a transaction is broadcast. A flawless ledger cannot compensate for a secret key that was never truly secret.
Written by the News Desk and edited by Samuel Rae.