Qubic halts network, says attacker drained 1,400+ wallets through weak seeds
In brief
- Attacker drained about $1.4 million from more than 1,400 Qubic wallets, the project says
- Qubic network halted at tick 85,371,949; no restart date announced
- 87.1% of the stolen QU never left the Qubic network, the project says
- MEXC froze the account that received the remaining 12.9%, according to Qubic
- Qubic computors will vote on a recovery plan that has not yet been decided
Where the stolen QU went
Qubic said the exploit led to 2.94 trillion Qubit (QU) being stolen.
Most of it didn't get far.
According to the project, 87.1% of the drained funds never left the Qubic network and remain frozen in place. Qubic described what happened to the rest in its statement:
"The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour."
That account of the freeze comes from Qubic. Cointelegraph said the project didn't immediately respond to its request for comment.
A Math.random() problem
Qubic said the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025. It says the flaw is fixed in the latest version of its web wallet. Cointelegraph pointed to a GitHub commit for version 4.26.4 showing the wallet swapped JavaScript's Math.random() function (which isn't suitable for generating cryptographic secrets) for the cryptographically secure crypto.getRandomValues() function when creating seeds.
Weak seeds aren't a new failure mode. In July, Coldcard disclosed that attackers had stolen funds from wallets whose seeds were weakened by a firmware bug, and similar flaws hit Trust Wallet's browser extension and the Libbitcoin Explorer tool in 2023.
Computors will decide on recovery
Qubic said its core team is identifying affected wallets and preparing recovery options for a vote by the network's Computors, who will decide what happens to the frozen funds. No plan has been settled yet. The team said it'll publish a full technical report once one is.
For context, Qubic is a layer-1 that supports transactions and smart contracts without fees. It's built on Useful Proof of Work (UPoW), a consensus mechanism that repurposes mining energy to train artificial intelligence. Its token had a market cap of about $62.6 million at the time of the report, according to CoinGecko data cited by Cointelegraph.
Exploits like this one are a big share of crypto losses. In the third quarter, hacks and exploits made up 19% of crypto crime cases but 40% of reported losses, according to AMLBot's 2026 investigations report, which looked at 250 investigations the firm had opened since the start of the year.
Frequently asked questions
What caused the Qubic wallet exploit?
Qubic blamed weakly generated wallet seeds. A GitHub commit for wallet version 4.26.4 shows Qubic replaced JavaScript's Math.random() function, which isn't suitable for cryptographic secrets, with the secure crypto.getRandomValues() function. Qubic says the flaw is fixed in the latest version of its web wallet.
Which Qubic wallets were affected by the weak-seed flaw?
Qubic said affected seeds were generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025.
What happens to the frozen Qubic funds?
Qubic says 87.1% of the stolen funds stayed on its network and remain frozen, and MEXC froze the account that received the other 12.9%. Qubic's core team is preparing recovery options, and the network's Computors will vote on what happens to the frozen funds. No plan has been settled, and Qubic hasn't said when the network will restart.
