Qubic Rolled Dice for 1,400 Wallet Seeds. The Dice Took $1.4 Million.
The seeds came out of a function that is not random. On a halted chain, most of the money is still sitting there.
Qubic, a layer-1 blockchain, halted on Sunday after an attacker used weakly generated wallet seeds to drain about $1.4 million from more than 1,400 accounts[1]. The chain stopped at tick 85,371,949[2].
The weak seeds came from any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025[2]. 2.94 trillion Qubit (QU) left[2]. Developers replaced the generator in version 4.26.4, swapping JavaScript’s Math.random() for crypto.getRandomValues()[3].
Qubic says 87.1% of the funds never left the network and remain frozen, and MEXC froze the receiving account within about an hour of the 12.9% arriving[4].
What to do: don’t move QUBIC through an exchange — Qubic notified exchanges, which suspended deposits and withdrawals, MEXC at the project’s request[5].
Who gains, who loses
Receipts
Qubic, a layer-1 blockchain, halted operations on Sunday after an attacker exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts.
“Layer-1 blockchain network Qubic halted operations Sunday after an attacker reportedly exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts, according to the project.”
Qubic said the network was halted at tick 85,371,949, and that the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025, leading to 2.94 trillion Qubit (QU) stolen.
“In a statement on X, Qubic said the network was halted at tick 85,371,949, where it remains paused at the time of writing. Qubic said the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a…”
Qubic developers fixed the seed-generation mechanism in version 4.26.4, replacing JavaScript's Math.random() with the cryptographically secure crypto.getRandomValues() function, and noted that creating new weak seed phrases is no longer possible.
“Developers fixed the generation mechanism in version 4.26.4. They noted that creating “new weak seed phrases is no longer possible.”
Qubic said 87.1% of the drained funds never left the Qubic network and remain frozen in place, while the remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour.
“87.1% of the drained funds never left the Qubic network and remain frozen in place,” said Qubic. “The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour.”
Qubic notified exchanges, which suspended QUBIC deposits and withdrawals, with MEXC explaining this was done at the project's request and Bitget citing technical maintenance of wallets.
“Qubic notified exchanges, which suspended QUBIC deposits and withdrawals. MEXC explained that this was done at the project’s request. Bitget cited technical maintenance of wallets.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.