Mentioned in This Article
1. What happened to Qubic's network?
Qubic, a layer-1 blockchain, stopped producing blocks after an attacker emptied roughly 1,404 user wallets in a window of about 104 minutes that ran from late on October 17 into the early hours of October 18. The team says about 2.94 trillion QU, worth roughly $1.3 to $1.4 million at the time, was moved. Network validators froze the chain at tick 85,371,949, and it has stayed paused since, with no restart date announced.
The theft was not carried out by breaking the protocol itself. According to the project, the weakness sat in the way certain wallets generated their secret seeds, which gave an attacker the chance to work out private keys that should have been unguessable. The attacker then swept the affected accounts one after another.
Because Qubic measures time in ticks rather than conventional blocks, the tick number is the official marker for the point at which the network stopped. Validators, which the project calls Computors, agreed to halt at that point so that the stolen funds could not be moved further while the team assessed the damage.
The pause is a notable step for any chain. Stopping a network protects what remains, but it also freezes every legitimate user, application and miner until the operators decide how to proceed. Qubic has said it will publish a full technical report, though only after a recovery plan has been settled.
2. How did weak seeds expose so many wallets?
A wallet seed is the random number from which every private key in the wallet is derived. If the process that produces it is predictable, an attacker can reproduce the same output and recover the keys without ever touching the victim's device. The security of the whole arrangement depends on the randomness being genuinely unpredictable.
Qubic says its web wallet used a random number function that was not designed for cryptographic purposes. In practice that means the values it produced could be narrowed down far more easily than a properly generated seed. Version 4.26.4 of the web wallet replaced it with a cryptographically secure function, and the project treats that update as the core fix.
The company has described the exposure by platform. Seeds created in any browser on an iPhone or iPad are affected. Seeds created in Safari on a Mac before October 18, 2026 are affected as well. For the Qubic iOS app, wallets created before July 2025 fall within the problem. Wallets created in other ways are not described as part of the incident.
The distinction matters for users, because simply updating the software does not repair a wallet that already exists. An account whose seed was generated by the flawed routine remains guessable, so holders in the affected groups would need to move their funds to a freshly generated identity rather than rely on the patch alone.
3. Where is the stolen money now?
Qubic states that 87.1% of the stolen funds never left its own network and remain frozen there. That figure is significant because it means the large majority of the loss is, at least for now, sitting in accounts that the network can restrict while its validators decide what to do.
The remaining 12.9% was sent to the exchange MEXC. According to Qubic, MEXC froze the receiving account within about an hour of the transfer. Exchange freezes of this kind are one of the few practical tools available after a theft, since an attacker usually needs a trading venue to turn stolen tokens into something spendable.
The final handling of the frozen balances has not been decided. Qubic says its Computors will vote on a recovery plan, and that vote will determine whether the funds are returned to the affected holders and how. The project has not said when the vote will take place.
At the time of publication, Qubic's token carried a market capitalization of around $62.6 million according to CoinGecko. Measured against that figure, the roughly $1.4 million stolen is a small share of total value, though it is spread across more than a thousand individual accounts.
4. Why did Qubic halt the chain instead of patching quietly?
Pausing a blockchain is an unusual response, and it reflects how Qubic is organized. Its validators can coordinate a stop, which a large, loosely governed network often cannot do. That coordination allowed the team to freeze the position quickly and keep the frozen share of funds from leaking out.
The halt also served a second purpose. While the chain is stopped, nothing further can be transferred, which gives the team room to identify which wallets were generated with the flawed routine and to prepare a plan without further losses piling up during the work.
The trade-off is trust. Users of any network that can be stopped by a group of validators are reminded that the same group could also decide how frozen balances are distributed. Qubic is leaning on that capacity here to protect victims, and the coming vote will show how the community uses it.
The project communicated through its posts on X and on GitHub. It did not respond to a request for comment from the outlet that first reported the story before publication, so most of the detail available now comes from the project's own statements.
5. A pattern of weak-randomness failures across crypto
Qubic's problem is the latest in a run of incidents where thefts followed from poorly generated randomness. In July, firmware flaws in Coldcard hardware wallets led to stolen funds. Earlier, in 2023, weaknesses were found in Trust Wallet's browser extension and in the Libbitcoin Explorer tool, both of which allowed attackers to derive private keys.
These cases share a common lesson. Cryptographic systems can be mathematically sound and still fail when the first step, creating a secret, relies on a source that is too predictable. Attackers who identify such a flaw can scan for vulnerable accounts at scale, which is why many victims can appear within a short period.
Industry data on the wider threat landscape points the same way. Figures from AMLBot indicate that hacks accounted for 19% of crypto crime cases in the third quarter of 2026 but about 40% of the reported losses. In other words, hacks are comparatively rare events that cause outsized damage when they occur.
For a network such as Qubic, which advertises feeless transactions and a model it calls Useful Proof of Work that redirects mining energy toward AI training, the incident is a security setback in a part of the stack that has little to do with those features. The vulnerability sat in wallet creation, not in consensus or mining.
6. What should affected holders do?
Anyone who created a Qubic wallet in a browser on an iPhone or iPad, in Mac Safari before October 18, 2026, or in the Qubic iOS app before July 2025 should treat the seed as compromised. The safest course is to generate a new identity with the updated wallet once the network is running again and to move holdings there.
Users should also avoid sharing seeds with anyone claiming to offer help. Incidents like this attract impersonators, and the project has no reason to ask a holder for a seed phrase. Official guidance will come through the project's own channels.
Holders who did not lose funds can only act once the chain resumes, because the network is currently paused. Until a restart, balances cannot be moved, and that includes the migration of unaffected accounts to safer seeds.
Exchanges are also part of the picture. Qubic's statement credits MEXC with acting quickly, and market venues that list QU may restrict deposits and withdrawals while the situation is unresolved. Traders should check the status of their platform before attempting a transfer.
7. What happens next for Qubic?
The next milestone is the validator vote on a recovery plan for the frozen funds. Qubic has not published a date for it. The outcome will indicate whether victims are made whole and how the project balances restitution against the precedent of intervening in a chain's state.
A restart of the network will follow only after that plan is in place. Qubic has said a complete technical report will be published once the recovery plan is settled, and that document should explain in more detail how the attack worked and how the team confirmed which wallets were exposed.
For the wider market, the episode adds to a record of wallet-level failures that are preventable. Security reviewers will likely look again at how wallets generate seeds on every platform, particularly in browsers, where the available random number tools differ and where a wrong choice is easy to make.
Until the report and the vote arrive, the facts that are firm are limited: 1,404 wallets drained, roughly 2.94 trillion QU taken, 87.1% frozen on the network, 12.9% frozen at MEXC, and a chain paused at tick 85,371,949.
8. What is Qubic and why does the flaw matter to it?
Qubic is a layer-1 blockchain that charges no transaction fees and describes its consensus approach as Useful Proof of Work, in which the energy normally spent on mining is redirected toward training artificial intelligence systems. Its validators, called Computors, play a central role in running the network and in making collective decisions such as the one now pending on the frozen funds.
Those design choices make the incident awkward for the project rather than fatal to its premise. The mining and consensus layers were not the source of the problem, and the team has said the weakness lay in how some wallets created their seeds. Even so, a feeless network that markets itself on efficiency depends on holders trusting that their accounts are safe, and a theft touching more than a thousand wallets tests that trust.
The size of the loss in dollar terms is modest next to the large exchange hacks that dominate headlines. What stands out instead is the cause: an ordinary setup step in common consumer environments, namely browsers on Apple devices, that quietly produced guessable secrets for a long period before anyone exploited it.