Layer-1 blockchain network Qubic halted operations after an attacker exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts. The network was paused at tick 85,371,949.
The vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until October 18, 2026, or the Qubic iOS app before July 2025. The attack resulted in the theft of 2.94 trillion Qubit (QU) tokens.
According to Qubic, 87.1% of the drained funds remained frozen on the network. The remaining 12.9% was sent to exchange MEXC, where the receiving account was frozen within approximately one hour.
Qubic identified the root cause as the use of JavaScript's Math.random() function for generating wallet seeds, which is not suitable for cryptographic purposes. The project has fixed the flaw in its latest web wallet version by replacing Math.random() with the cryptographically secure crypto.getRandomValues() function, according to a GitHub commit for version 4.26.4.
The core team is identifying affected wallets and preparing recovery options for a vote by Qubic's Computors, the network's governing entities. The team said it would publish a full technical report after a recovery plan is decided. The network restart timeline has not been announced.
This incident follows similar attacks involving weak wallet seed generation. In July, Coldcard disclosed that attackers had stolen funds from wallets weakened by a firmware bug. Trust Wallet's browser extension and the Libbitcoin Explorer tool experienced comparable flaws in 2023.
Qubic is a layer-1 blockchain supporting feeless transactions and smart contracts. It uses Useful Proof of Work (UPoW), a consensus mechanism that repurposes mining energy to train artificial intelligence. At the time of the incident, Qubic's token had a market capitalization of approximately $62.6 million.
