AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.
The layer-1 chain halted operations at tick 85,371,949 after an attacker drained 2.94 trillion QUBIC tokens across 1,400 compromised wallets.
Key points
- Qubic halted block production at tick 85,371,949 after 1,400 wallets lost 2.94 trillion QU, valued at $1.4 million.
- The vulnerability stemmed from weak Math.random() seed generation on Apple devices and Safari browsers through Oct. 18, 2026.
- Network validators will vote on remediation for the 87.1% of stolen assets currently frozen on-chain, while MEXC froze the rest.
Layer-1 blockchain network Qubic halted operations following an exploit that drained roughly $1.4 million across more than 1,400 accounts, according to project statements [1]. The network suspended processing at tick 85,371,949 and remains paused [1]. The incident resulted in the theft of 2.94 trillion $QU, the network's native asset, stemming from weakly generated wallet seeds across specific Apple operating systems and legacy application versions [1].
According to Qubic, the vulnerability impacted wallet seeds produced using any browser on an iPhone or iPad, Safari on macOS through Oct. 18, 2026, or the official Qubic iOS application prior to July 2025 [1]. Project representatives stated that 87.1% of the stolen capital never exited the Qubic blockchain and remains frozen on-chain, while the remaining 12.9% transferred to the centralized exchange MEXC [1]. The exchange froze the attacker's receiving account within approximately one hour of the transfer [1]. Weak key generation has presented ongoing systemic threats across the digital asset ecosystem, echoing self-custody incidents such as the Coldcard firmware vulnerability that weakened seed creation mechanisms [1].
Remediation and Recovery Roadmap
Qubic resolved the flaw in web wallet version 4.26.4, with a GitHub repository commit confirming the replacement of JavaScript's pseudo-random Math.random() function with the cryptographically secure crypto.getRandomValues() function [1]. Core developers are auditing affected accounts and drafting recovery proposals [1]. Network validators, known as Computors, will vote on governance measures to determine the disposition of the frozen assets [1].
The protocol operates an AI-oriented Useful Proof of Work consensus system, supporting fee-free smart contract execution [1]. Core contributors said a comprehensive technical post-mortem will be published after a restitution path is confirmed, though developers have not announced a formal timeline for network resumption [1].
FAQ
Which Qubic wallets were susceptible to the seed generation bug?
The flaw affected seeds generated via any browser on iOS or iPadOS, Safari on macOS up to Oct. 18, 2026, and the official Qubic iOS application before July 2025.
Are the drained Qubic funds permanently lost?
According to Qubic, 87.1% of the stolen assets remain frozen on-chain awaiting a validator vote, while the remaining 12.9% was frozen by exchange MEXC.
Sources
- Qubic freezes chain after attacker drains 1.4K wallets with weak seeds — Primary document (discovered)
Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.
Top comments (0)