TLDR
- The Qubic layer-1 blockchain suspended operations following a security breach that saw approximately $1.4 million worth of tokens stolen from over 1,400 user wallets.
- Hackers took advantage of inadequate randomness in wallet seed generation, making private keys vulnerable to compromise.
- Roughly 87.1% of the pilfered assets are currently locked within the network, while MEXC exchange secured the remaining portion by freezing the recipient account.
- A patch was released in web wallet version 4.26.4 to address the vulnerability, though wallets generated using previous versions may remain exposed.
- The network’s validator nodes, called Computors, are expected to vote on fund restitution measures, with no timeline announced for resuming operations.
The Qubic blockchain has suspended all operations after a hacker successfully extracted roughly $1.4 million worth of cryptocurrency from more than 1,400 user accounts. The team behind the project confirmed that approximately 2.94 trillion Qubic tokens were compromised in the incident.
Operations came to a halt at tick 85,371,949 on Sunday, October 18, and the network remained offline as of Monday.
The Qubic core development team explained that the perpetrator focused on accounts whose recovery seed phrases had been generated using inadequate randomness. This security weakness allowed the attacker to reverse-engineer the associated private keys with relative ease.
Majority of Compromised Assets Still Within Network
According to Qubic’s official statement, 87.1% of the stolen cryptocurrency never exited the network’s infrastructure and has been frozen at its current location. This represents approximately 2.56 trillion tokens.
The remaining 12.9%—roughly 379.26 billion tokens—was transferred to cryptocurrency exchange MEXC. The platform acted swiftly to freeze the destination account within approximately 60 minutes of receiving notification from the Qubic team.
MEXC subsequently disabled all deposit and withdrawal functions for Qubic at the project’s behest. Similarly, exchange XT suspended Qubic and Kasplex network transactions on October 18, attributing the action to wallet upgrades and scheduled maintenance.
Qubic has not yet verified whether any of the stolen digital assets have been returned to their rightful owners. Details regarding the recovery mechanism remain undisclosed.
Technical Details of the Security Vulnerability
The vulnerability originated from Qubic’s wallet software rather than the underlying blockchain protocol. Recovery seed phrases serve as the foundation for generating private keys that grant control over cryptocurrency holdings.
Vulnerable wallets include any seed phrases created through a browser on iPhone or iPad devices prior to October 18, 2026. Seed phrases generated using Safari on Mac computers before that date were similarly affected, along with those created through the Qubic iOS application before July 2025.
The development team addressed the security flaw in web wallet version 4.26.4. A GitHub commit reveals that the team swapped out JavaScript’s Math.random() function in favor of crypto.getRandomValues(), a cryptographically secure random number generator designed specifically for security applications.
While the patch protects newly generated wallet seeds, Qubic has not issued guidance confirming whether recovery phrases created with previous software versions can be considered secure.
This incident joins a growing list of cryptocurrency thefts linked to insufficient wallet seed randomness. In July 2026, malicious actors stole approximately 594 Bitcoin valued at $38 million from around 500 Coldcard wallet users due to a firmware defect.
In 2023, comparable vulnerabilities affected Trust Wallet’s browser extension and the Libbitcoin Explorer utility. The Libbitcoin vulnerability, dubbed Milk Sad, resulted in more than $900,000 worth of Bitcoin being stolen.
Qubic operates as a layer-1 blockchain platform that enables feeless transactions and smart contract functionality. The network utilizes Useful Proof of Work, a consensus mechanism that channels computational power toward artificial intelligence training applications.
According to CoinGecko data, the project’s native token maintained a market capitalization of approximately $62.6 million.
AMLBot’s 2026 investigations report indicates that hacks and exploits represented 19% of cryptocurrency crime incidents during the third quarter. Despite this relatively modest share of cases, these attacks accounted for 40% of total reported financial losses.
The core development team is currently working to identify all affected wallet addresses and formulating potential recovery strategies. The network’s validator operators, known as Computors, will conduct a vote to determine the fate of the frozen assets.
No recovery proposal has received approval at this time. Qubic stated it will publish a comprehensive technical analysis once a recovery framework has been finalized, though no date has been set for resuming network operations.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
