Qubic Freezes Chain After Weak Seeds Drain $1.4M From 1,400 Wallets

Update 10:54 UTC: The market has continued to reprice the incident: QUBIC fell 5.2% over the past 24 hours to $0.0000004394, roughly double the 2.8% decline in the total crypto market over the same window, according to the latest market data.

87.1% Frozen, 12.9% at MEXC

87.1% of the roughly $1.4 million stolen from Qubic wallets never left the network: it remains frozen in place on the halted chain. The other 12.9% was routed to MEXC, whose team locked the receiving account within roughly an hour of the transfers landing. The project disclosed both figures in its Sunday statement on X, and the two shares add up to the full amount taken. Qubic halted its blockchain at tick 85,371,949, a fixed point the network's block explorer still displays as the latest state, and at the time of writing the chain is paused with no restart date given. The project says an attacker exploited weak seed generation to drain 2.94 trillion Qubic (QU), worth about $1.4 million, from more than 1,400 accounts. Three generation paths produced the compromised keys, and the statement named each of them. Any wallet created in a browser on an iPhone or iPad was affected, as was one created in Safari on a Mac through Oct. 18, 2026, and the Qubic iOS app exposed users before July 2025. In each case the seed phrase, the master key from which a wallet derives all of its addresses, was built from too little randomness. That predictability let the attacker recompute private keys for a large batch of addresses at once. A predictable seed does not weaken one address in isolation; it can expose every address a wallet derives from it. Wallets created outside those three paths fall outside the warning, and no additional destinations appear in the project's account of the flow.

Math.random() Replaced in v4.26.4

The repair is already committed. A GitHub update for wallet version 4.26.4 shows the team pulled JavaScript's Math.random() function, never intended for cryptographic secrets, and replaced it with the cryptographically secure crypto.getRandomValues() when seeds are created; the change is live in the latest web wallet version. The patched release is what the team pointed to when it said it had fixed the flaw. The failure mode has precedent. In July, hardware cold wallet maker Coldcard disclosed that attackers had taken funds from wallets left exposed after a firmware bug weakened their seeds. Similar entropy flaws surfaced in 2023 in Trust Wallet's browser extension, along with the Libbitcoin Explorer tool. Weak randomness at generation time, in other words, keeps recurring across wallets of very different designs. In every case the wallet looked healthy on the surface; the keys it produced were simply guessable. Recovery now runs through Qubic's governance. The core team is working through the list of affected wallets and preparing recovery options for a vote by the network's Computors, the node operators who validate the chain, and they will decide what happens to the frozen funds. A full technical report will follow once a recovery plan is settled. The episode also shows why recovering a crypto wallet after a seed compromise is rarely straightforward, since the generation flaw is invisible to the user. Qubic itself is a feeless layer-1 blockchain that supports transactions and smart contracts, built on Useful Proof of Work, a consensus design that redirects mining energy into training AI models. Its token's market capitalization stood near $62.6 million at the time of reporting, per CoinGecko data. The broader quarter adds context: AMLBot's Q3 2026 investigations report, covering 250 cases opened since the start of the year, found hacks and exploits made up 19% of crypto crime cases yet 40% of reported losses.

Our reading: two documented facts capped the damage. The chain stopped while most of the stolen QU still sat in addresses the attacker controlled but could not move, and the single exchange off-ramp the thief is known to have used closed within the hour. What happens next is governance, not code. The Computor vote will set how the frozen 2.94 trillion QU is returned, and Qubic has not committed to a restart date, so tick 85,371,949 remains the chain's latest state. As of Sunday's statement, 87.1% of the stolen funds sat frozen on Qubic's own ledger and the remaining 12.9% in the locked MEXC account.

While the chain stays halted at tick 85,371,949, no transactions or smart contract executions can clear on Qubic, a practical effect the project's announcement makes explicit for a network whose feeless design normally runs both continuously. The freeze also lands on a sector where incidents of this type carry outsized cost: AMLBot's Q3 2026 report not only attributes 40% of losses to hacks and exploits but finds the average per-case loss in that category runs more than twice that of other crypto crime types. Qubic's team, meanwhile, has not named a restart timetable, and it says the full technical report will come only after the recovery plan is settled, leaving the Computor vote as the next formal step.

New timing details from the project's disclosure put the attack window at 104 minutes: it began Oct. 17 at 23:42 UTC and ended Oct. 18 at 01:26 UTC, during which 1,404 wallets were emptied of exactly 2,939,606,531,944 QU. Bitget also suspended QUBIC deposits and withdrawals alongside the MEXC freeze. The market reacted: Investing.com's historical data shows QUBIC fell about 10.42% on Oct. 18, overlapping the theft and the halt, and a CoinGecko snapshot from Oct. 19 put the price at $0.0000004622 with a circulating market cap near $66 million and 24-hour volume of about $970,000. The team also cautioned that the 4.26.4 patch secures only newly generated seeds, so affected users must recreate wallets in a safe environment and migrate funds once transfers resume, while guarding against impostors offering recovery help in exchange for seeds or private keys.

The market has continued to reprice the incident: QUBIC fell 5.2% over the past 24 hours to $0.0000004394, roughly double the 2.8% decline in the total crypto market over the same window, according to the latest market data. In its disclosure, the team drew a line around the protocol itself, stating that the issue was in seed generation and not in Qubic's design, and confirmed that Computors coordinated the halt at tick 85,371,949 as a network-level decision, with any resolution for the stolen QU left to a vote of the quorum under the network's rules. The core team is now mapping the affected identities and drafting proposals for that vote. Notably, the project is the same AI-based mining protocol behind last year's disputed claim to a majority of Monero's hashrate.