An overnight theft emptied 1,404 Qubic wallets of approximately 2.94 trillion QU, valued at $1.3 million, before validators halted the network on October 18. The attack exploited predictable wallet recovery seeds generated by older Apple software rather than a blockchain vulnerability.
How the Attack Unfolded
Unauthorized transfers occurred between 23:42 UTC on October 17 and 01:26 UTC on October 18. The attacker exploited insufficient randomness in the generation of 55-character wallet seeds, allowing them to reconstruct a smaller set of predictable seeds and identify wallets containing funds.
Affected wallets included those with seeds generated on iPhones and iPads through browsers, Macs running Safari, and older versions of Qubic's iOS application. Qubic developers stated the issue was corrected in version 4.26.4 and secured additional vulnerable funds before the attacker reached them.
Network Response and Frozen Funds
Computors, the network's validators, halted transactions at tick 85,371,949 early on October 18. Approximately 87.1% of the stolen QU remained on Qubic, immobilized by the network suspension. The remaining 12.9% reached cryptocurrency exchange MEXC, which froze the receiving account.
QEARN stakes were reportedly unaffected. Bitget subsequently suspended QUBIC deposits and withdrawals for maintenance. Whether victims receive reimbursement depends on decisions by Qubic's Computor quorum.
Qubic's native currency declined more than 10% on Sunday morning following the incident.
