Qubic Halts Network After $1.3 Million Wallet Drain

Qubic’s validators halted the network after an attacker drained about 2.94 trillion QU from 1,404 wallets, the project said on Oct. 18. The tokens were worth roughly $1.3 million at late Sunday morning prices.

In an 8:29 a.m. ET update, Qubic said the theft occurred between 7:42 p.m. and 9:26 p.m. ET on Oct. 17. Its validators, called Computors, coordinated a halt at tick 85,371,949, stopping all transaction processing. The network’s explorer also displayed that tick as its current position.

Qubic said 87.1% of the drained funds remained on the network, immobilized by the halt. The remaining 12.9% went to MEXC, whose team froze the receiving account within about an hour, according to Qubic. The halt also prevents other holders from transferring funds while the incident is resolved.

The Defiant’s calculation using CoinGecko’s price at 11:03 a.m. ET on Oct. 18 values the reported stolen tokens at about $1.26 million. CoinGecko put QUBIC’s circulating market capitalization at $61.8 million at that time. The dollar estimate is a market valuation, not the attacker’s realized proceeds.

Wallet Patch Replaces Insecure Randomness

Qubic attributed the theft to wallet seeds generated with “insufficient randomness,” which let the attacker access affected wallets. “The issue was in seed generation, not in the Qubic protocol itself,” the project said.

Its warning covers seeds created in any browser on an iPhone or iPad before Oct. 18, 2026; in Safari on a Mac before that date; or in the Qubic iOS app before July 2025.

The project said seed generation was corrected in version 4.26.4. The official web wallet’s release notes date that version to Oct. 18 and list a fix to “use cryptographically secure seed generation.”

The associated code change replaces `Math.random()` in the wallet’s seed-creation routines with `crypto.getRandomValues()`. MDN’s JavaScript documentation warns that `Math.random()` is not cryptographically secure and should not be used for security. Qubic said a full technical report would follow once recovery is settled.

For affected holders, Qubic advised filing a report with police or cybercrime authorities, including the wallet ID, amount lost and transaction link from its explorer. It said formal reports help exchanges keep funds frozen. The project also warned that its team would never initiate a private message, ask for a seed or offer paid recovery services.

Qubic said any resolution rests with the Computor quorum. Its core team was identifying affected addresses and preparing options for the validators, with a community poll open on Discord.