Overview
- The attacker ran a roughly 104‑minute raid between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18, draining 1,404 wallets for about 2.94 trillion QU, roughly $1.3–$1.4 million.
- Computors stopped the chain at tick 85,371,949 to contain the loss, leaving about 87.1% of the stolen QU frozen on‑chain and the remaining 12.9% sent to MEXC, whose receiving account was frozen.
- Qubic says the breach was not a protocol bug but stemmed from weak randomness when generating recovery seeds in legacy iPhone/iPad browsers, Safari on Mac, and older iOS app builds.
- Developers published web wallet v4.26.4 to replace Math.random() with crypto.getRandomValues() to stop creating new weak seeds, but the update does not retroactively secure seeds already generated.
- The core team is mapping affected wallets and preparing recovery proposals for a Computor vote with no approved plan or restart date yet, and the incident highlights recurring risks from poor entropy and unvetted wallet code for users and operators.