Qubic hit the brakes on its entire network after an attacker drained 1,404 wallets in about 104 minutes. The theft ran from 23:42 UTC on Oct. 17 to 01:26 UTC on Oct. 18, 2026. About 2.94 trillion QU walked out the door, valued at roughly $1.3 million to $1.4 million. Not a great night.
An attacker drained 1,404 Qubic wallets in 104 minutes, walking off with 2.94 trillion QU. Not a great night.
Here’s the twist. The core protocol wasn’t the problem. Qubic said the weakness sat in wallet seed generation, not in blockchain consensus or protocol logic. Reporting tied it to JavaScript’s Math.random), which was used to create seeds instead of a cryptographic source. That function is fine for shuffling a playlist. For guarding money, it’s a joke. The randomness was too weak, so the seeds were predictable, and predictable seeds mean an attacker can get into wallets.
The risk centered on Apple devices and browsers. Qubic warned that seeds generated in any browser on iPhone or iPad before Oct. 18, 2026 were affected. Seeds created in Safari on Mac before that date were also on the list. So were seeds from the Qubic iOS app made before July 2025. Older creation paths, in other words, carried the danger. Wallets that stay connected to the internet, known as hot wallets, are especially exposed to this kind of attack because their keys live on devices that are online.
Then came the freeze. Qubic halted transactions, and validators paused the chain while the incident was assessed. Some coverage put the halt at tick 85,371,949. The pause stopped further movement of stolen funds and bought time for containment and a recovery plan. Blunt, but effective.
Not everything stayed put. About 87.1% of the stolen funds reportedly remained inside the Qubic network and were frozen. The other 12.9% went to MEXC. The receiving account there was reportedly frozen too. While the network stays paused, the attacker’s ability to move or sell is restricted. So the loot is only partly contained, and the incident report made sure to say so.
Qubic publicly acknowledged the event on Oct. 18. The fix landed in version 4.26.4. Wallet seed-generation code reportedly now uses crypto.getRandomValues) instead of Math.random(). Simple change. Painful lesson. The response has focused on emergency containment, the seed fix, and recovery planning. The Qubic core team is also working to identify affected wallets so that recovery options can be assessed, and Computors will vote on the fate of the frozen funds.
The takeaway is hard to dodge. This was a wallet-generation failure, not a consensus failure. Weak randomness created predictable access, and more than 1,400 users paid for it in a short window. For context, Qubic’s token market capitalization stands at approximately $62.6 million. Non-cryptographic randomness has no business anywhere near wallet creation. Qubic’s chain was fine. The seeds weren’t. That distinction matters, but it’s cold comfort for any of the 1,404 wallet owners hit.
