Qubic has frozen its mainnet after a wallet seed-generation flaw was used to steal funds from more than 1,400 accounts. The project said the attackers took about $1.4 million, equal to 294 trillion Qubic units (QU), and that the chain is now halted at tick 85,371,949.
Seed-generation bug traced to Math.random()
In a post on X, Qubic said the root cause was JavaScript’s Math.random() function. The project said wallet seeds were generated with ordinary random numbers rather than a cryptographically secure randomness source, weakening the resulting seeds.
According to Qubic, the affected environments included wallets created in browsers on iPhone and iPad, Safari on Mac through Oct. 18, and the Qubic iOS app before July 2025.
The team said it submitted a fix on GitHub. Version 4.26.4 replaces the old method with crypto.getRandomValues() for seed generation.
Most of the stolen funds remain on-chain
Qubic said the 294 trillion stolen Qubic units have not fully left the network. The project said 87.1% of the funds remain frozen and unmoved on-chain, while the remaining 12.9% was transferred to the MEXC exchange and frozen within about one hour.
CoinGecko data cited in the report put Qubic’s market capitalization at about $62.6 million. While the freeze remains in place, no transactions can be processed and no smart contracts can be executed on the network.
Part of a broader pattern of weak-seed incidents
The report said Qubic is not the only case tied to weak seed generation. In July this year, Bitcoin hardware wallet maker Coldcard disclosed a firmware bug that weakened seeds and was followed by a series of theft cases. Earlier, in 2023, Trust Wallet’s browser extension and the Libbitcoin Explorer tool also saw similar seed-generation defects.
The report also cited AMLBot’s third-quarter survey, which said hacks and vulnerabilities accounted for 19% of cases but 40% of total losses, with average losses per case more than twice those of other categories.
Recovery plan still pending
Qubic’s core team said it is identifying affected wallets and preparing a recovery plan. The next step is for the network’s Computors to vote on how the frozen funds should be allocated.
The team said it will publish a full technical report after a full recovery plan is finalized. It has not announced a timeline for restarting the network.
What the incident highlighted
The report said the case shows a less visible wallet risk: even without a direct compromise or theft event, a flaw in seed-generation logic can still cause users to lose control of their funds. It also noted that mobile wallets are a common entry point for users in Taiwan, making it a basic security check to confirm that a wallet app uses a cryptographically secure randomness source.
The report added that Qubic uses the Useful Proof of Work, or UPoW, consensus mechanism, under which miners’ computing power is used not only for mining but also for training AI models. In projects that sit at the intersection of AI and crypto, the cost of infrastructure bugs such as weak-seed flaws can become more visible.
