Overview
- An attacker drained 1,404 Qubic wallets in under two hours between late Saturday, Oct. 17 and early Sunday, Oct. 18, taking about 2.94 trillion QU tokens worth roughly $1.3–$1.4 million.
- Qubic’s Computor validators stopped the mainnet at tick 85,371,949, which froze about 87.1% of the stolen QU on-chain while roughly 12.9% reached the MEXC exchange and its receiving account was frozen.
- Qubic says the breach came from weak, predictable wallet seed generation on certain Apple/browser environments and older iOS app versions rather than a protocol flaw, and the team issued web wallet v4.26.4 that replaces Math.random() with crypto.getRandomValues() to prevent new vulnerable seeds.
- The network’s operators, the Computors, must vote on recovery options and a restart date, no plan has been approved, and affected users have been asked to file police or cybercrime reports to support any restitution process.
- The incident echoes earlier seed- and RNG-related losses this year and highlights a recurring systemic risk: secure blockchains can still leave funds exposed if client-side wallet entropy is poor, which has already pressured liquidity, exchange access, and holder confidence.