Qubic Halted the Chain With 87% of the Stolen $1.3M Still On It
The seed phrases were made with too little randomness. One attacker opened 1,404 wallets in 104 minutes.
One attacker drained 1,404 Qubic wallets of about 2.94 trillion QU, worth about $1.3 million[1]. It took 104 minutes, starting 23:42 UTC on 17 October[2][3].
The seed phrases had too little randomness, so they were weaker than they should be[4]. The attacker used that gap to move funds to addresses the attacker controlled[4]. The team says the flaw hit seeds made in iPhone and iPad browsers[5]. Mac Safari seeds are covered until 18 October 2026[5]. The iOS app is covered until July 2025[5].
Computors halted the chain at tick 85,371,949[6]. Per the Qubic team, 87.1% of the funds stayed in the network[7]. The other 12.9%, about 379 billion QU, went to MEXC[8]. MEXC froze that account in about an hour[8].
What to do: version 4.26.4 fixes the seed maker, the team says[9].
Who gains, who loses
Receipts
An attacker drained 1,404 Qubic user wallets of roughly 2.94 trillion QU tokens, worth about $1.3 million at the time, prompting the network to pause its mainnet on October 18, 2026.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
At the current rate, the damage is estimated at around $1.3 million, and the attack took the hacker approximately 104 minutes.
“At the current rate, the damage is estimated at around $1.3 million.”
Some seed phrases were generated with insufficient randomness, making them weaker than they should be, which the attacker exploited to gain access to the wallets and transfer funds to controlled addresses.
“Some seed phrases were generated with insufficient randomness, making them weaker than they should be.”
The vulnerability affected seed phrases created on iPhone and iPad through any browser until October 18, 2026, on Mac through Safari until October 18, 2026, and in the Qubic mobile app for iOS until July 2025.
“According to the team, the vulnerability affected seed phrases created: - on iPhone and iPad through any browser until October 18, 2026; - on Mac through Safari until October 18, 2026; - in the Qubic mobile app for iOS until July 2025.”
Qubic network operators, known as Computors, agreed to an emergency blockchain halt at tick 85,371,949 after discovering the attack.
“After discovering the attack, Qubic network operators, known as Computors, agreed to an emergency blockchain halt at tick 85,371,949.”
According to the team, 87.1% of the stolen funds—about 2.56 trillion QU—remain within the network, while the remaining 12.9%, or approximately 379 billion QU, were sent by the attacker to the crypto exchange MEXC.
“According to the team, 87.1% of the stolen funds—about 2.56 trillion QU—remain within the network.”
The remaining 12.9%, or approximately 379 billion QU, were sent by the attacker to the crypto exchange MEXC, whose team froze the receiving account within about an hour.
“The remaining 12.9%, or approximately 379 billion QU, were sent by the attacker to the crypto exchange MEXC. The exchange's team froze the receiving account within about an hour.”
Developers fixed the generation mechanism in version 4.26.4, noting that creating new weak seed phrases is no longer possible.
“Developers fixed the generation mechanism in version 4.26.4.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.