Qubic halts network after attacker drains 1,404 wallets with weak seeds

An attacker drained 1,404 wallets at once on Qubic, a fee-free layer-1 blockchain. In a security incident update posted on X on Oct. 18, Qubic said the attacker took about 2.94 trillion of its native QU coins from those wallets over 1 hour and 44 minutes, from 8:42 a.m. to 10:26 a.m. Korea time on Oct. 18. At the MEXC price just before the attack, that is worth about $1.4 million. The nodes that validate the network halted the entire chain so the drained coins could not move further.

1. Oct. 18, 08:42 KSTAttacker begins draining Qubic wallets with weak seeds
2. Oct. 18, 10:26 KSTLast withdrawal; about 2.94 trillion QU taken from 1,404 wallets
3. Oct. 18, 13:22 KSTWeb wallet 4.26.4 released on GitHub with new seed generation
4. Oct. 18, 21:29 KSTQubic posts incident update and scale of losses on X
5. Oct. 19, 5 a.m. KST hourQUBIC on MEXC falls about 13% below its pre-attack price (hourly candle)

Seeds made in Safari became the target

A seed is the secret string used to open a wallet and move coins. Qubic said some wallet seeds were generated with insufficient randomness, making them weaker than they should be, and the attacker exploited this. The company said the issue was in seed generation, not in the Qubic protocol itself.

Qubic identified three groups of affected seeds: those created on an iPhone or iPad in any browser before Oct. 18, 2026; those created on a Mac using Safari before Oct. 18, 2026; and those created in the Qubic iOS app before July 2025. The web wallet's change history on GitHub shows that the JavaScript Math.random() function used to pick the letters of the 55-character seed was replaced with the cryptographic random function crypto.getRandomValues(). Math.random() is not meant for generating security secrets. Qubic said seed generation has been corrected in version 4.26.4 and no new weak seeds can be created.

This is not the first time weak randomness has left wallets exposed. In 2023, similar flaws surfaced in Trust Wallet's browser extension and in Libbitcoin Explorer, a bitcoin tool. Qubic itself suffered an incident on July 13, when one account in its GitHub organization was compromised and information was taken from its repositories. At the time, Qubic told some web wallet users to move their funds to a new address.

A chain frozen at tick 85,371,949

Qubic processes transactions in units called "ticks" rather than blocks. The validator nodes that run the network, known as Computors, coordinated a protective halt of the network at tick 85,371,949. Qubic said that while no transactions are processing, the drained funds cannot be moved or sold.

According to the company, 87.1% of the drained coins never left the Qubic network and remain frozen in place. The remaining 12.9%, about 379 billion QU, was sent to the MEXC exchange, which froze the receiving account within about an hour. Qubic said it notified other exchanges, which have suspended QUBIC deposits and withdrawals. It has not said when the network will restart.

451 Computors will decide on recovery

Qubic said, "Any resolution is a decision for the Computor quorum, under the rules of the network." According to Qubic's official documentation, there can be at most 676 Computors, and a quorum decision requires votes from at least 451 of them, or two-thirds. The core team is identifying every affected wallet address and preparing options for the quorum, and a community poll has been opened on Discord. Qubic said a full technical report will follow once recovery is settled.

Qubic urged affected users to file a report with the police or cybercrime authorities in their country, including their wallet address, the amount lost and the transaction link from the Qubic explorer, saying formal reports are needed for exchanges to keep the funds frozen. "Nobody from Qubic will ever message you first, ask for your seed, or offer recovery services for a fee," the company said, warning users about impersonators.

Not on Korean won markets, down 8% abroad

QUBIC is not listed on the Korean won markets of Upbit, Bithumb or Coinone. On MEXC's hourly chart, QUBIC closed the 7 a.m. hour on Oct. 18, just before the attack, at $0.0000004747. It fell about 13% to as low as $0.0000004145 in the 5 a.m. hour on Oct. 19, and around 10:30 a.m. on Oct. 19 it traded at $0.0000004383, about 8% below its pre-attack level. Trading on exchanges has continued even with the network halted. QUBIC's market capitalization is about $62.9 million, according to CoinGecko.