Qubic has halted its layer-1 blockchain after an attacker exploited a wallet security flaw to steal approximately 2.94 trillion QU tokens worth $1.4 million from more than 1,400 accounts.
Summary
- Qubic halted its blockchain after attackers exploited weak wallet recovery seeds to steal approximately $1.4 million from more than 1,400 accounts.
- About 87.1% of the stolen tokens remain frozen on the network, while MEXC restricted an account that received the remaining funds.
- Developers have fixed the wallet seed generation flaw, but previously affected wallets may remain vulnerable.
- Network operators have yet to approve a recovery plan, and Qubic has not announced when blockchain operations will resume.
According to an Oct. 18 statement from the Qubic core team, the attacker targeted wallets whose recovery seeds had been generated with insufficient randomness, leaving their private keys vulnerable to discovery.
— Qubic (@_Qubic_) October 18, 2026Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ
The network was suspended at tick 85,371,949 to prevent further movement of the stolen tokens. Qubic said 87.1% of the stolen funds remained within the network when operations stopped, while the remaining 12.9% had reached cryptocurrency exchange MEXC.
The exchange froze the receiving account within approximately an hour, according to the project.
Qubic has not announced when its blockchain will resume operations, with the recovery of stolen assets awaiting a decision from its network operators, known as Computors.
Qubic wallet vulnerability traced to weak seed generation
The attack exploited a flaw in the way certain Qubic wallets generated recovery seeds, which are used to derive the private keys controlling cryptocurrency holdings.
Weak randomness during seed generation can make private keys easier to reconstruct, allowing an attacker to access a wallet without obtaining its recovery phrase directly from the owner.
Qubic identified several categories of affected wallets based on the device, browser and application used when the recovery seed was created.
Wallets generated through any browser on an iPhone or iPad before Oct. 18, 2026, were affected, along with seeds created through Safari on Mac computers before the same date.
The vulnerability extended to seeds generated through the Qubic iOS application before July 2025.
The project said the problem originated in its wallet software and did not involve a compromise of the underlying blockchain protocol.
Developers have since corrected the seed-generation flaw in web wallet version 4.26.4, according to the project’s security update.
The reported change replaced JavaScript’s Math.random() function with crypto.getRandomValues(), which is designed to generate cryptographically secure random values.
JavaScript’s Math.random() is not intended for generating private keys or other cryptographic secrets because its output does not provide the security guarantees required for such operations.
Although the correction addresses the method used to generate new wallet seeds, the project has not established that recovery phrases created under the vulnerable software are secure.
Qubic said it would publish a full technical investigation after its recovery plan had been settled.
Qubic freezes stolen tokens as exchanges suspend transfers
The network halt has left most of the stolen tokens frozen while the development team examines the affected wallets and prepares recovery proposals.
Based on Qubic’s reported figures, approximately 2.56 trillion QU remained on the blockchain when transaction processing stopped.
The remaining 379.26 billion QU had been transferred to MEXC, where the receiving account was restricted following contact with the exchange.
MEXC subsequently suspended QUBIC deposits and withdrawals at the project’s request. The restriction prevented customers from moving tokens through the affected network while the incident was being investigated.
Cryptocurrency exchange XT introduced a similar suspension on Oct. 18, citing wallet upgrades and maintenance. The announcement covered deposit and withdrawal services on both the QUBIC and KASPLEX networks.
Although the restrictions prevented transfers through those services, Qubic has not confirmed that any of the stolen tokens have been returned to their original owners.
The core team is identifying compromised wallets and preparing recovery proposals for a vote by the network’s Computors.
Computors participate in Qubic’s consensus process and will decide how the frozen funds should be handled under the proposed recovery arrangements.
The project has not announced whether recovery would involve reversing unauthorized transfers, returning frozen tokens through another mechanism or compensating affected users separately.
No final recovery plan has been approved.
Earlier wallet seed flaws led to millions in crypto losses
The Qubic exploit follows several cryptocurrency security incidents involving weaknesses in the generation of wallet recovery seeds.
In July 2026, Bitcoin hardware wallet manufacturer Coldcard disclosed a firmware vulnerability that allowed attackers to target wallets whose recovery phrases had been generated using insufficient randomness.
The flaw was traced to a firmware configuration introduced in March 2021, which caused affected devices to use a predictable software random-number generator instead of their intended hardware source.
As crypto.news previously reported, attackers stole approximately 594 BTC worth $38 million from around 500 Coldcard wallets during a 25-minute attack on July 31.
The vulnerability reduced the effective entropy of some wallet seeds from the intended 128 bits to approximately 40 bits, leaving affected private keys exposed to attempts to guess them through repeated calculations.
Coldcard subsequently released updated wallet firmware on Aug. 20, introducing additional safeguards that required users to contribute their own randomness when generating new recovery phrases.
The manufacturer warned that installing updated software would not repair seeds created under vulnerable firmware versions. Affected holders were instructed to generate new wallets and transfer their Bitcoin.
Similar problems had affected other cryptocurrency wallet applications in previous years.
In August 2023, a Libbitcoin Explorer vulnerability was linked to the theft of more than $900,000 from Bitcoin users.
The weakness, known as Milk Sad, involved a faulty key-generation process that allowed attackers to predict private keys associated with certain wallet seeds.
Security researchers found that the bx seed command lacked sufficient randomness, potentially allowing the same recovery seed to be generated more than once.
Trust Wallet disclosed a separate browser extension vulnerability in April 2023 that affected wallet addresses created during a limited period in November 2022.
The company identified two suspected exploits involving approximately $170,000 in losses and announced a reimbursement process for affected users.
Trust Wallet said the issue had been fixed and advised holders of affected addresses to transfer their funds to newly generated wallets.
Qubic recovery awaits network operator approval
Qubic’s core team is working to identify the accounts affected by the October attack before submitting recovery proposals to its Computors.
The network operates using Useful Proof of Work, a consensus mechanism designed to direct mining computation toward artificial intelligence workloads. Its blockchain supports smart contracts and transactions without conventional transaction fees.
At the time of the original incident report, Qubic’s market capitalization stood at approximately $62.6 million, according to CoinGecko.
The security incident occurred during a period when hacks and exploits accounted for a substantial portion of reported cryptocurrency losses.
According to AMLBot’s 2026 investigations report, hacks and exploits represented 19% of cryptocurrency crime cases during the third quarter but accounted for 40% of reported financial losses.
The blockchain investigation company based its findings on 250 investigations opened since the beginning of the year.
Qubic said it would publish a full technical report after the recovery plan was settled, while the date for restarting network operations remained unannounced.