Qubic Exploit Results in $1.4 Million Worth of Frozen Stolen Tokens

Operations on the Qubic layer-1 blockchain were paused after an attacker leveraged a wallet security loophole to siphon nearly 2.94 trillion QU tokens—valued at $1.4 million—from over 1,400 user accounts.

Based on an October 18 statement from the Qubic core team, the attacker compromised wallets where recovery seeds were generated with weak randomness, exposing private keys to easy discovery.

The network was suspended at tick 85,371,949 to halt any additional transfer of the stolen assets. Qubic confirmed that 87.1% of the stolen funds stayed inside the system prior to the shutdown, whereas the other 12.9% reached the MEXC crypto exchange.

The receiving account was frozen by MEXC within roughly an hour, according to details shared by the project team.

No timeline was announced by Qubic regarding when its blockchain will resume operations, as the recovery of stolen assets depends on a decision from its network operators, known as Computors.

Qubic Wallet Vulnerability Linked to Weak Seed Generation#

The breach exploited a flaw in how specific Qubic wallets generated recovery seeds, which are used to derive private keys controlling cryptocurrency holdings.

Inadequate randomness during seed creation enables private keys to be reconstructed more easily, allowing an attacker to access a wallet without directly obtaining the recovery phrase from its owner.

Several groups of affected wallets were identified by Qubic based on the device, browser, and software utilized when creating the recovery seed.

The flaw affected wallets created through any browser on an iPhone or iPad prior to Oct. 18, 2026, alongside seeds generated via Safari on Mac computers before that same deadline.

The vulnerability was extended to seeds generated through the Qubic iOS application prior to July 2025.

The issue was traced by the project to its wallet software, confirming that no breach occurred within the underlying blockchain protocol itself.

The seed-generation flaw was corrected by developers in web wallet version 4.26.4, according to the project’s official security update.

The reported patch replaced JavaScript’s Math.random() function with crypto.getRandomValues(), which developers design to generate cryptographically secure random values.

JavaScript’s Math.random() is not built for producing private keys or cryptographic secrets, as its output lacks the security guarantees required for such sensitive operations.

Although developers fixed the generation method for new wallet seeds, safe status was not established for recovery phrases created under the vulnerable software version.

A comprehensive technical report was promised by Qubic once the core team finalizes its recovery plan.

Most of the stolen tokens were frozen by the network halt while the development team examines the affected wallets and prepares recovery proposals.

Qubic Freezes Stolen Tokens as Exchanges Halt Transfers#

Based on figures released by Qubic, approximately 2.56 trillion QU stayed on the blockchain when transaction processing stopped.

The remaining 379.26 billion QU was transferred to MEXC, where exchange operators restricted the destination account shortly after initial contact.

MEXC subsequently suspended QUBIC deposits and withdrawals at the project’s request, preventing customers from moving tokens across the affected network while team members investigated the breach.

Cryptocurrency exchange XT introduced a similar suspension on Oct. 18, citing wallet upgrades and maintenance. The announcement covered deposit and withdrawal services on both the QUBIC and KASPLEX networks.

Although these restrictions blocked transfers across those services, Qubic has not confirmed that original owners have recovered any of the stolen tokens.

Compromised wallets are being identified by the core team while developers prepare recovery proposals for a vote by the network’s Computors.

Computors participate in Qubic’s consensus process, and a decision on how the frozen funds should be handled will be made by these operators under the proposed recovery arrangements.

The project has not announced whether recovery would involve reversing unauthorized transfers, returning frozen tokens through alternative mechanisms, or compensating affected users separately.

No final recovery plan was approved by the governing body.

The Qubic exploit follows several cryptocurrency security incidents that stemmed from weaknesses in how software systems generate wallet recovery seeds.

Past Wallet Seed Vulnerabilities Caused Millions in Crypto Losses#

In July 2026, a firmware vulnerability was disclosed by Bitcoin hardware wallet manufacturer Coldcard that enabled attackers to target wallets whose recovery phrases were created using insufficient randomness.

The flaw was traced by security researchers to a firmware configuration from March 2021, which caused affected devices to use a predictable software random-number generator instead of their intended hardware source.

Approximately 594 BTC worth $38 million was stolen from around 500 Coldcard wallets during a rapid 25-minute attack on July 31, as previously reported.

The security flaw reduced the effective entropy of certain wallet seeds from the intended 128 bits down to roughly 40 bits, leaving private keys vulnerable to brute-force recovery attacks.

An updated wallet firmware was released by Coldcard on Aug. 20, introducing additional safeguards that required users to contribute extra randomness when generating new recovery phrases.

The manufacturer warned that installing updated software would not repair seeds created under vulnerable firmware versions, and holders were instructed to generate new wallets and transfer their Bitcoin.

Similar technical problems had impacted several other cryptocurrency wallet applications during previous years.

In August 2023, security researchers linked a Libbitcoin Explorer vulnerability to the theft of more than $900,000 from Bitcoin users.

The flaw, dubbed Milk Sad, involved a flawed key-generation mechanism that allowed malicious actors to predict private keys associated with specific wallet seeds.

Security researchers discovered that the bx seed command lacked sufficient randomness, which meant the same recovery seed could potentially be generated multiple times.

A separate browser extension vulnerability was disclosed by Trust Wallet in April 2023, affecting wallet addresses created during a limited period in November 2022.

Two suspected exploits involving approximately $170,000 in losses were identified by the company, which also announced a reimbursement process for affected users.

Trust Wallet confirmed that the issue was fixed and advised holders of affected addresses to transfer their funds to newly created wallets.

Qubic Recovery Depends on Network Operator Approval#

The core team at Qubic is actively identifying the accounts impacted by the October exploit before presenting recovery proposals to its Computors.

The network operates through Useful Proof of Work, a consensus mechanism engineered to redirect mining computation toward artificial intelligence tasks. Its blockchain handles smart contracts and transactions without requiring traditional network fees.

When the initial incident report was published, Qubic’s market capitalization stood at approximately $62.6 million, according to CoinGecko.

The security incident took place during a period when hacks and exploits accounted for a substantial portion of reported cryptocurrency losses.

Data from AMLBot’s 2026 investigations report indicates that hacks and exploits made up 19% of crypto crime incidents during Q3 while generating 40% of overall financial losses.

The blockchain analytics firm based its findings on 250 separate investigations launched since the start of the year.

Qubic stated that a comprehensive technical report would be published once the recovery strategy was finalized, though officials have not yet announced a date for restarting network operations.