Qubic, a layer-1 blockchain that supports feeless transactions and smart contracts, has halted its network at tick 85,371,949 after an attacker exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts. The project said 2.94 trillion Qubit (QU) was taken in the incident, which targeted wallets whose seeds were created under specific conditions on Apple devices and browsers. At the time of writing, the chain remained paused while the core team identified affected wallets and prepared a recovery plan for the network’s Computors to vote on.
The halt is a dramatic response to a wallet-generation failure rather than a flaw in the chain’s core consensus software. Qubic said the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025. Those conditions matter because they narrow the set of wallets exposed to the bug, but they also show how a single weak source of randomness can create a broad class of vulnerable accounts across devices and app versions.
Network Frozen at Tick 85,371,949
Qubic announced that the network was halted at tick 85,371,949, where it remained paused at the time of writing. The project did not announce when the network would restart. The freeze gives the team time to identify affected wallets, trace the stolen funds, and design a recovery process that must be approved by the network’s Computors.
Halting a layer-1 chain is a serious step. It stops new transactions, smart contract activity, and settlement across the network. In this case, the project appears to have chosen the pause because a large share of the stolen funds never left the Qubic network. According to Qubic, 87.1% of the drained funds remained onchain and were frozen in place. That means the attacker’s ability to move most of the proceeds was limited by the network halt, even though the theft had already occurred.
The remaining 12.9% was sent to MEXC, a crypto exchange. Qubic said the exchange’s team froze the receiving account within about an hour. The split between onchain funds and exchange-held funds is central to the recovery plan: onchain funds may be recoverable through a validator vote or protocol-level action, while the exchange-held portion depends on cooperation and the exchange’s own account-freezing procedures.
How Weak Seeds Became the Attack Surface
Wallet seeds are the foundation of crypto self-custody. A seed phrase or seed value is used to derive private keys, and those keys control the addresses that hold funds. If the seed is generated with insufficient randomness, an attacker can reproduce or guess it and then derive the same keys. Once that happens, the attacker can sign transactions and drain the wallet without needing to compromise the user’s device, password, or physical backup.
The Qubic incident is tied to seed generation, not to a stolen private key from a single user or a phishing campaign. The project said the flaw affected seeds created in certain environments, including any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, and the Qubic iOS app before July 2025. The common thread is the method used to generate randomness at the moment the wallet was created.
The project has fixed the seed-generation flaw in the latest version of its web wallet. A commit for version 4.26.4 shows that Qubic replaced JavaScript’s Math.random() function with the cryptographically secure crypto.getRandomValues() function when creating wallet seeds. Math.random() is not suitable for generating cryptographic secrets because it is not designed to provide unpredictable, high-quality randomness. Security experts have long warned that using general-purpose random number generators for keys or seeds can make wallets vulnerable. crypto.getRandomValues(), by contrast, is intended for cryptographic use in browser environments.
Even with the patch, the incident shows why wallet generation deserves the same scrutiny as smart contracts and consensus code. A wallet can use a secure blockchain, a well-audited client, and a strong password, but if the seed was created with weak entropy, the resulting keys may be guessable. The flaw can remain invisible to users because the wallet looks normal after creation. The weakness sits underneath the user experience.
Recovery Plan and the Computors Vote
Qubic said its core team is identifying affected wallets and preparing recovery options for a vote by the network’s Computors. The Computors will decide what happens to the frozen funds. The team said it would publish a full technical report after a recovery plan is settled. It has not announced when the network will restart.
The recovery vote raises difficult questions that are common in blockchain incidents. If the frozen funds are returned, the network must decide how to verify ownership, how to treat wallets that were drained, and whether to compensate affected users from the frozen balance. If the funds are not returned through a protocol-level action, affected users may have to rely on tracing, exchange cooperation, or legal processes. The fact that 87.1% of the funds remained onchain gives the project more options than an incident in which all assets were bridged or swapped immediately.
The halt also creates a tradeoff. Keeping the chain paused protects the frozen funds and prevents the attacker from moving them, but it disrupts all users and applications that depend on the network. Qubic is a feeless layer-1 that supports transactions and smart contracts, so a prolonged pause can affect developers, merchants, and ordinary holders. The project has not given a restart timeline, which leaves the network in a holding pattern while the recovery process unfolds.
A Familiar Pattern of Weak Wallet Seeds
The Qubic theft is the latest in a series of attacks tied to weak wallet seeds. In July, Coldcard disclosed that attackers had stolen funds from wallets whose seeds were weakened by a firmware bug. Similar flaws affected Trust Wallet’s browser extension and the Libbitcoin Explorer tool in 2023. Those incidents share a basic lesson: wallet security depends on the quality of randomness used at the moment of key creation, and a small implementation mistake can expose many wallets at once.
Weak-seed incidents can be especially damaging because they are not always visible to users. A person can create a wallet, back up the seed phrase, and store it offline, but if the seed was generated with predictable randomness, the backup does not fix the underlying problem. Attackers can generate the same seed or narrow the search space and then sweep funds from multiple wallets. The result is a broad, automated theft rather than a targeted phishing attack.
For wallet developers, the Qubic incident reinforces the need to use audited cryptographic libraries, avoid non-cryptographic random functions, and test seed generation across platforms. Browser environments, mobile apps, and operating system versions can all affect the APIs available for randomness. A wallet that works securely on one device may use a different code path on another. The Qubic bug affected specific Apple-related environments and older app versions, which suggests that platform-specific code paths and version history matter in security reviews.
What the Incident Means for Qubic and Its Users
Qubic is a layer-1 blockchain that supports transactions and smart contracts without fees. It is built on Useful Proof of Work, a consensus mechanism that repurposes mining energy to train artificial intelligence. Qubic’s token had a market capitalization of about $62.6 million at the time of writing. The network’s feeless design and AI-focused consensus make it distinctive, but the incident shows that distinctive consensus and fee models do not remove the need for secure wallet generation.
The project’s response has focused on containment. The network halt, the freeze of onchain funds, and the exchange freeze at MEXC all aim to preserve assets while the team prepares a recovery plan. The next steps depend on the Computors vote and the technical report. Users affected by the bug will want to know how the project defines an affected wallet, what evidence will be required, and whether the recovery plan will restore the stolen QU or provide another form of compensation.
The incident also highlights the role of exchanges in crypto incident response. The 12.9% sent to MEXC was frozen within about an hour, according to Qubic. That quick action prevented the attacker from converting at least part of the proceeds through a centralized venue. But exchange freezes depend on timely reporting, account identification, and cooperation. Onchain funds require a different set of tools, including network-level freezes, tracing, and validator governance.
Broader Crypto Security Losses in 2026
The Qubic incident comes as crypto security losses remain a major concern. In the third quarter, hacks and exploits accounted for 19% of crypto crime cases but 40% of reported losses, according to a 2026 investigations report based on 250 investigations opened since the start of the year. That gap suggests that while hacks and exploits may be less frequent than other categories of crypto crime, they tend to be far more costly per case.
Weak-seed vulnerabilities fit that pattern. They can affect many wallets at once, and the losses can be concentrated in a short period. The Qubic attacker reportedly drained more than 1,400 accounts and took 2.94 trillion QU. The project’s ability to freeze 87.1% of the funds onchain may limit the final loss, but the incident still raises questions about wallet creation standards, platform-specific randomness, and the governance tools available when a large-scale theft occurs.
For now, Qubic remains paused at tick 85,371,949. The core team is identifying affected wallets and preparing a recovery vote. The full technical report is expected after a recovery plan is settled. The network has not announced when it will restart, and the final outcome will depend on how the Computors choose to handle the frozen funds.
Source:Cointelegraph News