A wallet seed generation flaw led to Qubic’s massive breach, prompting a network halt while most stolen funds remain frozen.
Qubic has confirmed that an attacker drained 1,404 wallets, stealing around 2.94 trillion QU during a security incident between October 17 and 18.
The network said the problem came from weak wallet seed generation, not a flaw in the Qubic protocol itself.
Weak Wallet Seeds
According to the update, some wallet seeds were created with insufficient randomness, making them easier to compromise. The affected seeds were generated on iPhones and iPads using any browser before October 18, on Macs using Safari before that date, or through the Qubic iOS app before July 2025.
Qubic’s validators, known as Computors, coordinated a halt at tick 85,371,949 to prevent further movement of the stolen funds. With transactions paused, 87.1% of the drained funds remain on the network and frozen. The other 12.9% was sent to MEXC, which froze the receiving account within about an hour. Exchanges have also been notified and have suspended QUBIC deposits and withdrawals.
The team asserted that the seed generation issue has been fixed in version 4.26.4. No new weak seeds can be created under the corrected system. The next steps will depend on the Computor quorum, which will decide how the incident is resolved under the network’s rules. The Core team is identifying affected identities and preparing options for the quorum. A community poll is also open on Discord to gather feedback.
The layer-1 blockchain network has urged affected users to report the incident to local police or cybercrime authorities. Reports should include the wallet ID, the amount lost, and the transaction link from the Qubic explorer.
September Nightmare
The Qubic incident comes after a costly September for the crypto industry. As reported by CryptoPotato, PeckShield counted 55 major crypto hacks during the month, as losses reached almost $766.5 million. That was around 462% higher than August’s $136.3 million.
You may also like:
Two incidents accounted for most of the damage. The Bitget breach involved around $387 million, while the Liquid Network theft totaled roughly $320 million. Liquid later recovered $285 million. Bitget CEO Gracy Chen said an attacker exploited a backend system to manipulate transaction data and bypass authorization checks. The exchange plans to cover the loss through its User Protection Fund, which holds more than $464 million.
The Liquid Network theft, on the other hand, involved roughly 4,000 BTC withdrawn from its federation wallet. The attacker promised to return the funds after network nodes were patched, though Ledger CTO Charles Guillemet questioned whether the attacker was a legitimate security researcher.