Qubic Blockchain Frozen After Hacker Drains 1,400 Crypto Wallets
Blockchain network Qubic has suspended operations after an attacker exploited a wallet security vulnerability to steal approximately $1.4 million in cryptocurrency from more than 1,400 wallets.
The attack, which occurred over the weekend of October 17–18, targeted wallets created using weakly generated recovery seeds.
Approximately 2.94 trillion Qubic tokens were stolen from 1,404 wallets before the network was halted.
Qubic’s developers say most of the affected funds have been contained, while the community prepares to decide on a recovery plan.
What Happened to Qubic?
The attacker exploited a weakness in how certain Qubic wallets generated their recovery seeds.
A wallet seed is secret information used to generate the cryptographic keys controlling cryptocurrency. If an attacker can reproduce that seed, they may be able to access the wallet without the owner’s permission.
In this case, the affected software reportedly used insufficiently secure randomness when generating wallet seeds, making some wallets vulnerable to attack.
Qubic identified the following affected wallet-creation environments:
- Wallets created using browsers on iPhones and iPads before October 18, 2026.
- Wallets created using Safari on Mac computers before October 18, 2026.
- Wallets created using the Qubic iOS application before July 2025.
The vulnerability concerned how wallet credentials were generated, rather than a confirmed breach of the blockchain’s underlying consensus mechanism.
Qubic Freezes Network to Prevent Further Losses
Following the attack, Qubic’s network operators coordinated an emergency halt at tick 85,371,949.
A tick is part of Qubic’s transaction-processing system, broadly comparable to a blockchain’s progression through successive processing intervals.
Stopping the network prevented additional transactions while developers investigated the incident.
According to Qubic’s reported statement:
- 87.1% of the stolen tokens remained on the Qubic network and were effectively frozen by the halt.
- 12.9% had been transferred to cryptocurrency exchange MEXC, which reportedly froze the receiving account.
- The core team began identifying affected wallets and developing potential recovery arrangements.
These measures may help prevent further movement of the funds, but they do not guarantee that victims will recover their cryptocurrency.
As of October 19 reporting, Qubic had not announced a confirmed date for restarting its network.
What Caused the Security Vulnerability?
The incident appears to have originated from a weakness in Qubic’s wallet software.
According to reports, the affected wallet-generation process used JavaScript’s Math.random() function.
Although useful for ordinary programming tasks, Math.random() is not designed to generate secure cryptographic secrets.
Qubic’s updated web wallet, version 4.26.4, replaced that function with crypto.getRandomValues(), which provides cryptographically secure random values.
The change addresses the identified seed-generation weakness for newly created wallets.
However, updating wallet software does not automatically make previously exposed seeds safe.
Users whose wallets were created using affected software should follow official Qubic guidance rather than assume an update alone resolves the risk.
Frequently Asked Questions
How much cryptocurrency was stolen from Qubic?
Approximately 2.94 trillion Qubic tokens, valued at about $1.4 million at the time of reporting, were stolen from 1,404 wallets.
Was the Qubic blockchain itself hacked?
The reported vulnerability affected how some wallets generated their recovery seeds. There is no confirmed evidence in the cited reporting that the attacker broke Qubic’s underlying blockchain cryptography.
Has Qubic recovered the stolen funds?
Qubic reported that 87.1% of the stolen tokens remained on its halted network, while the rest were frozen at MEXC. This does not mean victims have already received their funds back.
Are all Qubic wallets affected?
No. The reported vulnerability affected wallets created using specific software and device combinations during particular periods.
Can a wallet software update recover stolen cryptocurrency?
No. Updating the software can prevent the same seed-generation weakness in newly created wallets, but it does not reverse completed thefts or automatically secure previously compromised recovery seeds.
