The company Qubic has halted its layer-1 blockchain after an attacker exploited a wallet security vulnerability to steal approximately 2.94 trillion QU tokens worth $1.4 million from more than 1400 accounts.
According to a statement from the core Qubic team dated October 18, the attacker targeted wallets whose backup seed phrases were generated with an insufficient degree of randomness, making their private keys vulnerable to discovery.
Network operations were suspended at epoch 85 371 949 to prevent further movement of the stolen tokens. Qubic said that 87.1% of the stolen funds remained in the network at the time of the halt, while the remaining 12.9% was sent to the cryptocurrency exchange MEXC.
According to the project, the exchange blocked the recipient's account within about an hour.
Qubic has not yet announced when its blockchain will resume operations, as the question of returning the stolen assets awaits a decision from the network operators known as Computors.
Qubic wallet vulnerability linked to weak seed value generation
The attack exploited a vulnerability in the way backup keys (seeds) are generated in some Qubic wallets, which are used to derive the private keys controlling cryptocurrency assets.
Weak randomness in seed value generation can make it easier to recover private keys, allowing an attacker to gain access to a wallet without obtaining the recovery phrase directly from the owner.
Qubic identified several categories of affected wallets based on the device, browser, and application used to create the seed phrase.
The issue affected wallets created through any browser on an iPhone or iPad before October 18, 2026, as well as seed phrases created through Safari on Mac computers before the same date.
The vulnerability extended to seed values generated using the Qubic iOS app before July 2025.
The project stated that the problem arose in the wallet software and was not related to a compromise of the underlying blockchain protocol.
According to the project's security update, developers fixed the seed phrase generation bug in web wallet version 4.26.4.
Reportedly, as a result of the changes made, the Math.random() function in JavaScript was replaced with crypto.getRandomValues(), which is designed to generate cryptographically secure random values.
The Math.random() method in JavaScript is not intended for generating private keys or other cryptographic secrets, as its output does not provide the security guarantees required for such operations.
Although the fixes address the method of generating new seed phrases for wallets, the project has not proven the security of recovery phrases created with the vulnerable software.
Qubic said it will publish the results of a full technical investigation once the recovery plan is approved.
Qubic froze the stolen tokens, and exchanges suspended transfers.
Due to the network halt, most of the stolen tokens are frozen while the development team examines the affected wallets and prepares recovery proposals.
According to data published by Qubic, approximately 2.56 trillion QU remained in the blockchain at the time transaction processing was discontinued.
The remaining 379.26 billion QU was transferred to MEXC, where access to the recipient's account was restricted after the exchange was contacted.
Subsequently, MEXC suspended deposits and withdrawals in QUBIC at the project's request. This restriction prevented clients from moving tokens through the affected network while the incident was being investigated.
The cryptocurrency exchange XT introduced a similar suspension on October 18, citing wallet updates and maintenance. The announcement applied to deposit and withdrawal services in both the QUBIC and KASPLEX networks.
Although the restrictions prevented transfers through these services, Qubic has not confirmed that any of the stolen tokens have been returned to their original owners.
The core team is working to identify compromised wallets and prepare recovery proposals for a vote among network users.
Participants in the Qubic computer process will decide how the frozen funds should be handled as part of the proposed recovery measures.
The project has not yet reported whether the recovery will include reversing unauthorized transfers, returning the frozen tokens through another mechanism, or separate compensation to affected users.
The final recovery plan has not yet been approved.
See also:
