Overview
- An attacker emptied 1,404 Qubic wallets in a 104-minute raid that ran late on October 17 into early October 18, and validators stopped the chain at tick 85,371,949 to lock the ledger.
- Developers say the exploit was not a bug in the blockchain but came from weak, predictable wallet seeds generated on legacy Apple devices, Safari and older iOS wallet builds.
- About 87% of the stolen 2.94 trillion QU (~$1.3 million) was frozen on-chain by the halt, while roughly 13% reached MEXC and the receiving account was frozen; Bitget suspended QUBIC deposits and withdrawals.
- Qubic released client v4.26.4 to fix the seed-generation flaw, said its staking product QEARN was unaffected, and asked victims to file police reports as the Computor cluster prepares a vote on restitution and a restart.
- The theft underscores risks from third-party wallet tooling, tightens short-term liquidity for holders, and follows an August Vottun bridge breach that highlighted the same vulnerability of peripheral systems.