Qubic Freezes Chain After Weak Seeds Drain $1.4M From 1,400 Wallets

87.1% Frozen, 12.9% at MEXC

87.1% of the roughly $1.4 million stolen from Qubic wallets never left the network: it remains frozen in place on the halted chain. The other 12.9% was routed to MEXC, whose team locked the receiving account within roughly an hour of the transfers landing. The project disclosed both figures in its Sunday statement on X, and the two shares add up to the full amount taken. Qubic halted its blockchain at tick 85,371,949, a fixed point the network's block explorer still displays as the latest state, and at the time of writing the chain is paused with no restart date given. The project says an attacker exploited weak seed generation to drain 2.94 trillion Qubic (QU), worth about $1.4 million, from more than 1,400 accounts. Three generation paths produced the compromised keys, and the statement named each of them. Any wallet created in a browser on an iPhone or iPad was affected, as was one created in Safari on a Mac through Oct. 18, 2026, and the Qubic iOS app exposed users before July 2025. In each case the seed phrase, the master key from which a wallet derives all of its addresses, was built from too little randomness. That predictability let the attacker recompute private keys for a large batch of addresses at once. A predictable seed does not weaken one address in isolation; it can expose every address a wallet derives from it. Wallets created outside those three paths fall outside the warning, and no additional destinations appear in the project's account of the flow.

Math.random() Replaced in v4.26.4

The repair is already committed. A GitHub update for wallet version 4.26.4 shows the team pulled JavaScript's Math.random() function, never intended for cryptographic secrets, and replaced it with the cryptographically secure crypto.getRandomValues() when seeds are created; the change is live in the latest web wallet version. The patched release is what the team pointed to when it said it had fixed the flaw. The failure mode has precedent. In July, hardware cold wallet maker Coldcard disclosed that attackers had taken funds from wallets left exposed after a firmware bug weakened their seeds. Similar entropy flaws surfaced in 2023 in Trust Wallet's browser extension, along with the Libbitcoin Explorer tool. Weak randomness at generation time, in other words, keeps recurring across wallets of very different designs. In every case the wallet looked healthy on the surface; the keys it produced were simply guessable. Recovery now runs through Qubic's governance. The core team is working through the list of affected wallets and preparing recovery options for a vote by the network's Computors, the node operators who validate the chain, and they will decide what happens to the frozen funds. A full technical report will follow once a recovery plan is settled. The episode also shows why recovering a crypto wallet after a seed compromise is rarely straightforward, since the generation flaw is invisible to the user. Qubic itself is a feeless layer-1 blockchain that supports transactions and smart contracts, built on Useful Proof of Work, a consensus design that redirects mining energy into training AI models. Its token's market capitalization stood near $62.6 million at the time of reporting, per CoinGecko data. The broader quarter adds context: AMLBot's Q3 2026 investigations report, covering 250 cases opened since the start of the year, found hacks and exploits made up 19% of crypto crime cases yet 40% of reported losses.

Our reading: two documented facts capped the damage. The chain stopped while most of the stolen QU still sat in addresses the attacker controlled but could not move, and the single exchange off-ramp the thief is known to have used closed within the hour. What happens next is governance, not code. The Computor vote will set how the frozen 2.94 trillion QU is returned, and Qubic has not committed to a restart date, so tick 85,371,949 remains the chain's latest state. As of Sunday's statement, 87.1% of the stolen funds sat frozen on Qubic's own ledger and the remaining 12.9% in the locked MEXC account.