Qubic halts chain after 1,404 wallets lose $1.4 million

Qubic halted its blockchain after an attacker drained 1,404 wallets with weak seeds, leaving most of about $1.4 million in stolen QU frozen while the network weighs recovery. The attack ran from 23:42 UTC on Oct. 17 to 01:26 UTC on Oct. 18. Cointelegraph’s report, citing Qubic, says the theft totaled 2.94 trillion QU.

A wallet seed is the secret from which a wallet’s keys are derived. It works like a master key: anyone who can reproduce it can control the wallet’s funds. Qubic said some seeds had insufficient randomness, making them weaker than intended. The attacker used those vulnerable seeds to access and drain accounts; the reported issue was in seed generation, not the blockchain protocol.

Which Qubic wallets were affected?

Qubic identified seeds created in any browser on an iPhone or iPad, in Safari on a Mac before Oct. 18, 2026, or in its iOS app before July 2025 as potentially affected. The project said its latest web wallet version fixes the seed-generation flaw. It did not report that every wallet made in those circumstances was drained.

The distinction matters because a wallet’s seed controls access regardless of where its funds are held. If an attacker can guess or reproduce a weak seed, the chain sees a valid transaction from that wallet. That is different from breaking the chain’s transaction rules or exploiting a smart contract.

How did the chain halt, and where are the funds?

Qubic stopped network activity at tick 85,371,949, a point in its sequence of network updates. With the chain paused, 87.1% of the stolen funds remained on Qubic, according to the project. The other 12.9% went to an account at crypto exchange MEXC, which Qubic said froze it within about an hour.

The halt acts like closing a door while a response is organized: it prevents transactions on the paused network from moving the on-chain portion. It also stops ordinary network activity, so the freeze carries a cost for users beyond the affected wallets. The project has not announced when Qubic will resume.

Who decides what happens to the stolen QU?

Qubic said its core team was identifying affected wallets and preparing recovery options for a vote by the network’s Computors. That vote will decide what happens to the frozen funds. The project has not yet announced the outcome or promised compensation to wallet holders.

The immediate technical fix addresses new seed generation in the web wallet; it does not itself return the stolen tokens or settle the status of the funds already frozen. Qubic said it plans to publish a full technical report after a recovery plan is settled. Until then, the confirmed picture is a halted chain, most stolen QU still on it, and a decision pending from the Computors.

Source material

• Cointelegraph’s report — cointelegraph.com