Qubic suspended its layer-1 blockchain after an attacker exploited a wallet seed generation flaw to drain 1,404 addresses of approximately 2.94 trillion QU, worth around $1.4 million, between 23:42 UTC on 17 October and 01:26 UTC on 18 October 2026.
The theft stemmed from insufficient randomness during wallet recovery seed generation, not from a compromise of the underlying blockchain protocol. Qubic said vulnerable configurations included wallets created through any browser on an iPhone or iPad before 18 October 2026, wallets generated via Safari on macOS before that date, and seeds created with the Qubic iOS application before July 2025.
The network was halted at tick 85,371,949, freezing about 87.1% of the stolen tokens, or roughly 2.56 trillion QU, on the blockchain. The remaining 12.9%, approximately 379 billion QU, reached MEXC, which froze the receiving account within about an hour and suspended QUBIC deposits and withdrawals at Qubic’s request. XT and Bitget also announced related deposit and withdrawal suspensions.
Qubic has not announced when blockchain operations will resume. Recovery proposals are being prepared for a vote by the network’s validators, known as Computors, and no final recovery plan has been approved. Developers fixed the seed generation flaw in web wallet version 4.26.4 by replacing Math.random() with crypto.getRandomValues(), but previously generated vulnerable recovery phrases may remain unsafe.
At the time of the incident, Qubic’s market capitalization stood at approximately $62.6 million, according to CoinGecko. The project said it would publish a full technical report after recovery arrangements are settled and warned users against unsolicited recovery offers or requests for private keys.
