Qubic halts blockchain after weak wallet seeds drain 1,404 accounts

Qubic halted its network on Sunday, October 18, after an attacker took approximately 2.94 trillion QU tokens from the affected accounts. Qubic said in its security incident announcement that the blockchain stopped at tick 85,371,949 and that its Computors, or validators, would vote on a proposed recovery plan.

The incident involved about $1.4 million in assets, according to Cointelegraph’s report on the Qubic wallet drain. The loss was not described as a smart-contract exploit or an exchange breach. Instead, the attacker exploited weakly generated wallet seeds, the secret values from which users’ private keys are derived.

That distinction places responsibility closer to the wallet software and its credential-generation process than to the consensus code securing Qubic’s chain. It also creates a difficult policy question: whether validators should intervene to protect users when the underlying blockchain itself was not compromised.

The affected wallets

Qubic said in a separate notice about affected seeds that the vulnerability applied to seeds generated on iPhones or iPads using any browser, on Mac computers using Safari before October 18, 2026, or through the Qubic iOS application before July 2025. The project said the seed-generation problem was fixed in version 4.26.4.

Qubic’s web wallet has also been updated, according to the project’s account. The change replaces JavaScript’s Math.random function with crypto.getRandomValues, a browser feature designed for cryptographically secure random values.

The difference is important because wallet security depends on unpredictability. If attackers can reproduce or narrow the possible values used to create a seed, they may be able to derive the same wallet credentials without breaking the blockchain’s cryptography. In that situation, transactions signed by the attacker can appear valid because the attacker possesses the key material associated with the wallet.

Qubic’s public explorer records the latest network tick as 85,371,949, according to the Qubic Explorer, supporting the project’s statement that the chain remains paused at that point. Qubic has not announced when normal operation will resume.

The project said 87.1% of the stolen funds never left the Qubic network and remain frozen. It said the remaining 12.9% was transferred to MEXC, where the receiving account was frozen within about an hour. Those details leave the proposed Computor vote with two distinct tasks: determining what to do with assets still inside the network and deciding whether any recovery mechanism should be applied to affected users.

The cost of reversing the response

The proposed vote is the most consequential part of the incident because it could establish a precedent beyond Qubic’s immediate losses. If validators approve the recovery proposal, they may effectively reassign or immobilize assets based on the circumstances under which they were obtained, even though the transactions may have followed the network’s normal rules.

CryptoGrind, in a critical analysis of the Qubic incident, argues that nobody needed to break Qubic’s chain because the wallet seeds were guessable. Its criticism focuses on the wallet layer, but it also questions the decision to halt a blockchain presented as immutable while a recovery plan is debated.

That argument exposes a tension in Qubic’s architecture and governance. Immutability is often understood to mean that valid transactions cannot be erased or reversed by a central administrator. Yet Qubic’s response demonstrates that operational control over validators and network activity can still influence what happens after a loss. The chain can be paused, funds can remain frozen and a vote can determine whether affected users receive some form of remediation.

For users, that may be reassuring in the short term. For developers and institutional participants, it may make the boundaries of finality less clear. A network that can intervene during a wallet-layer incident may offer a consumer-protection tool, but it also introduces governance discretion into disputes over asset ownership.

What remains unresolved

Trenchbook, in a neutral review of the affected wallet seeds, said it independently checked Qubic’s claims against public RPC data and on-chain transfers. It also noted that the reported MEXC freeze remained based on Qubic’s account and that the technical cause of the weak seeds had not yet been fully disclosed.

That missing technical detail matters for assessing the scale of the risk. Users need to know whether the vulnerability was limited to specific devices and software versions, whether old seeds can be identified reliably, and whether wallets created through other interfaces could share the same weakness.

Qubic’s planned technical report is therefore likely to be as important as the recovery vote. It will need to explain how the seeds became predictable, how affected accounts were identified and what safeguards prevent a recurrence.

The episode is also a reminder that blockchain security extends beyond consensus mechanisms. A network may resist attacks on its ledger while users remain exposed through browser APIs, mobile applications and outdated wallet software. Qubic’s decision now forces its validators to balance immediate restitution against the longer-term credibility of predictable rules, a choice that could shape confidence in the project well beyond the frozen funds.