Layer-1 blockchain Qubic halted operations on October 18, 2026, after an attacker drained approximately 2.94 trillion QU—valued at roughly $1.4 million—from 1,404 wallets over a 104-minute period. Network validators, called Computors, stopped the chain at tick 85,371,949.
Root Cause: Weak Seed Generation
The compromise did not stem from a protocol vulnerability. Instead, the attacker exploited a weak random number generator in the wallet's seed creation layer, specifically JavaScript's Math.random() function, which is not designed for cryptographic applications.
Seeds generated with Math.random() produce predictable patterns, allowing the attacker to reconstruct wallet seeds without brute force. The affected wallets included those created in any browser on iPhone or iPad, Safari on Mac before October 18, 2026, or in the Qubic iOS app before July 2025.
Similar seed-entropy attacks have struck the industry previously. Coldcard users experienced losses exceeding $100 million from a firmware random number generator failure earlier in 2026. The XRP Healthcare wallet also suffered a key-generation flaw that drained $452,000 from 4,011 users.
Response and Fund Recovery
Of the drained amount, 87.1% remained on the Qubic network and was locked in place by the Computors' halt. The remaining 12.9% was transferred to exchange MEXC, which froze the receiving account within approximately one hour. Both MEXC and Bitget subsequently suspended QUBIC deposits and withdrawals.
Qubic's team patched seed generation in web wallet version 4.26.4 by switching to crypto.getRandomValues(). The core protocol and QEARN staking functionality remained unaffected.
Next Steps
The core team is identifying all affected wallets, with recovery options subject to a Computor vote. A full technical report is planned after a recovery plan is confirmed. No restart date has been announced for the network or exchange services.
Affected users are advised to file police or cybercrime reports including their wallet ID, drained amount, and explorer links. Such reports can support additional exchange-level freezes of stolen funds.
