Qubic halted its blockchain after attackers exploited a security flaw in the seed-generation process used by some older wallets, draining 1,404 wallets in 104 minutes and stealing about 2.94 trillion QU tokens worth roughly $1.3 million, according to the team’s Oct. 18 incident report.
The project said the attack targeted wallets whose seeds may have been generated with insufficient randomness. In response, Qubic network operators coordinated an emergency halt and worked with exchanges to freeze suspicious funds.
Attack window lasted 104 minutes
According to Qubic’s official explanation, the attack started at 23:42 UTC on Oct. 17 and ended at 01:26 UTC on Oct. 18, lasting 1 hour and 44 minutes. A total of 1,404 wallets were emptied during that period, with losses reaching 2,939,606,531,944 QU.
After the abnormal activity was detected, Qubic’s network operator nodes, known as Computors, coordinated a halt of the blockchain at tick 85,371,949. At the time the incident note was published, about 87.1% of the stolen tokens were still on-chain and could not be moved because the network had been stopped. The remaining 12.9% had already reached MEXC, where the related accounts were frozen. Bitget also suspended QUBIC deposit and withdrawal services.
Qubic said frozen funds should not be treated as recovered funds. Whether victims will be compensated, and how the affected assets will ultimately be handled, will depend on network governance decisions.
Older seed-generation flow identified as the weak point
The technical issue at the center of the incident was the lack of sufficient randomness in some wallet seeds. Under normal conditions, wallet seeds should be generated through a cryptographically secure random number generator so outside attackers cannot predict private keys. Qubic said certain legacy wallets produced predictable seeds, allowing attackers to derive possible seed combinations and then identify wallets holding assets.
The project listed the following risk scope:
- iPhone and iPad: Qubic seeds generated through the device browser before Oct. 18, 2026.
- Mac Safari: Qubic seeds generated through Safari before Oct. 18, 2026.
- Early Qubic iOS app: seeds generated through the app before July 2025.
Qubic added that the issue is limited to a specific Qubic seed-generation process. It does not mean Apple devices, Safari, or all cryptocurrency wallets created in those environments have the same vulnerability.
Version 4.26.4 fixes future seed generation, not old private keys
Qubic has released wallet version 4.26.4, replacing the old method with a random number generation process that meets cryptographic security requirements. But the update only improves seeds created from this point forward. It does not automatically make previously generated private keys safe if they were already predictable.
For that reason, users in the affected group still need to create a new wallet in a secure environment and move their assets to an address generated with a new seed once the network resumes normal transfers. Qubic also warned users about scams that impersonate the official team and claim to help recover assets, saying users should not share seeds or private keys with anyone.
Token price came under pressure as the chain was paused
The incident also weighed on QUBIC’s market price. According to a CoinGecko market snapshot available on Oct. 19, QUBIC was priced at $0.0000004622, with a circulating market capitalization of about $66 million, 24-hour trading volume of about $970,000, and a 24-hour range of $0.0000004161 to $0.0000004644.
Separately, historical price data from Investing.com showed QUBIC fell about 10.42% on Oct. 18, overlapping with the theft and chain halt.
By pausing the entire network, Qubic was able to limit further movement of most of the stolen assets, but regular users were also unable to process transactions as usual. The next issues for the project include whether the network can resume safely, how victims may be compensated, and whether wallets exposed to weak seeds can complete migration.
