Qubic Halts Chain After Attacker Drains 1,400 Weak-Seed Wallets

Qubic, a layer-1 blockchain network, halted operations after an attacker reportedly exploited weak wallet seeds to steal funds from more than 1,400 accounts. In a post shared on X, the project said the attack resulted in losses of roughly $1.4 million and that it had paused the network to contain further damage.

The incident follows a broader pattern of crypto security failures tied to improperly generated or otherwise vulnerable wallet seed material. Earlier this year and in past years, multiple wallet and tooling ecosystems faced incidents linked to seed weaknesses—making Qubic’s event part of an ongoing, widely shared risk among users and developers.

Key takeaways

• Qubic said an attacker exploited weakly generated wallet seeds, draining about $1.4 million from 1,400+ accounts.
• The network was halted at block/tick 85,371,949 and remains paused, according to Qubic’s status updates.
• Qubic reported that 87.1% of the drained funds remain frozen inside the Qubic network, while 12.9% was reportedly sent to MEXC and then frozen.
• The project tied the vulnerability to seed generation in certain Apple/Safari and iOS app environments and said it has already patched its web wallet.
• Recovery is expected to involve a vote by Qubic’s Computors, who will decide how the frozen funds are handled.

Network pause after a reported seed-generation exploit

According to Qubic’s statement on X (https://x.com/_qubic_/status/2111796725677715474), the network was stopped at tick 85,371,949. Qubic said it remains paused at the time of writing, with the project pointing to its network explorer (https://explorer.qubic.org/network) as confirmation.

Qubic’s team attributed the theft to wallets whose seeds were generated using specific browser and app conditions. In its account of the incident, the project said the vulnerability applied to seed generation using any browser on iPhones or iPads, Safari on a Mac until Oct. 18, 2026, and the Qubic iOS app prior to July 2025.

As a result of the weakness, Qubic reported that attackers stole 2.94 trillion Qubit (QU). The project did not suggest that all wallet users were affected; instead, it emphasized that the issue was tied to where and how seeds were created.

Where the stolen funds went—and what remains recoverable

One of Qubic’s most specific details relates to fund flow after the exploit. The project said 87.1% of the drained funds never left the Qubic network and remain frozen in place. The remaining 12.9%, Qubic added, was sent to MEXC, where the receiving account was frozen within about an hour.

This split matters for users and investors because it changes the practical odds of recovery. When a large portion of an incident remains within the network and is already frozen, it reduces the dependency on external enforcement and can make technical recovery pathways more feasible. Still, Qubic stressed that any final outcome depends on governance actions—meaning the funds’ ultimate disposition is not automatic.

A recurring weakness theme: “weak wallet seeds” in prior incidents

Qubic’s event is the latest entry in a sequence of attacks linked to weakly generated wallet seeds. Earlier coverage and disclosures from other parties cited similar root causes.

Cointelegraph previously reported that Coldcard disclosed attackers had stolen funds from Bitcoin wallets whose seeds were weakened by a firmware bug (https://cointelegraph.com/news/coldcard-bitcoin-theft-100-million-three-waves). In 2023, the same broad category of issue affected Trust Wallet’s browser extension and the Libbitcoin Explorer tool, according to earlier reporting (referenced in the source text through Cointelegraph coverage).

While each incident has its own technical details, the pattern is consistent: when wallet secrets are generated with predictability—or with randomness that is insufficient for cryptographic needs—attackers can sometimes derive or recreate seed-derived keys. That can turn ordinary wallet usage into a target, especially when users generate seeds in vulnerable environments without knowing the risk.

Qubic’s patch and the planned recovery process

Qubic said it has fixed the seed-generation flaw in the latest version of its web wallet. The project pointed users to a GitHub repository for its wallet code (https://github.com/qubic/wallet) and indicated that a specific update replaced JavaScript’s Math.random() usage with crypto.getRandomValues() when creating wallet seeds.

That distinction is important: Math.random() is generally not designed for cryptographic secret generation, while crypto.getRandomValues() is intended to provide cryptographically secure random values in supported browser environments. Qubic’s commit for version 4.26.4—described in the source—shows that the team made a direct change to eliminate the weak randomness source.

Beyond the patch, Qubic said its core team is identifying affected wallets and preparing recovery options. It also said a vote by the network’s Computors will decide what happens to the frozen funds. Qubic added that it plans to publish a full technical report after a recovery plan is settled, but it has not announced when the network will restart.

For users, this introduces a key uncertainty: even if funds are frozen and partially recoverable, the final timeline for access may depend on governance scheduling and the complexity of account identification and verification.

Security pressure on the wider crypto ecosystem

Qubic’s pause underscores a broader issue for crypto infrastructure: “hacks and exploits” have remained a dominant driver of losses during periods when criminal activity is otherwise elevated. In the source text, AMLBot’s 2026 investigations report is cited, stating that hacks and exploits accounted for 19% of crypto crime cases but 40% of reported losses across 250 investigations opened since the start of the year (https://blog.amlbot.com/crypto-crime-investigation-report-q3-2026/).

That imbalance helps explain why seed-generation failures remain so consequential. Even a relatively narrow software or environment bug can have outsized impact if it systematically weakens key material for many users.

Qubic also described its broader network design as a layer-1 chain built on Useful Proof of Work (UPoW), which repurposes mining energy to train artificial intelligence. It further said Qubic transactions and smart contracts run without fees. While those features don’t affect the root cause of a seed-generation issue, they may shape user expectations for uptime and reliability—making the decision to halt the network a high-stakes response.

Market data cited in the source indicated Qubic had a market capitalization of about $62.6 million at the time of writing, according to CoinGecko (https://www.coingecko.com/en/coins/qubic).

For now, the most important things to watch are Qubic’s governance vote outcome by the Computors, the timing of its recovery communications and technical report, and the eventual restart decision. Until then, the remaining frozen funds and the handling of affected wallets will likely determine how quickly users can regain certainty after the exploit.