Qubic Halts Chain After Weak Seeds Drain 1,404 Wallets of About $1.4 Million
By Crypto Wire
October 19, 2026
Qubic halted its fee-less layer-1 after an attacker drained 1,404 wallets of about 2.94 trillion QU — roughly $1.4 million at weekend prices — by reconstructing weakly generated recovery seeds, the project said in an October 18 incident update on X that Cointelegraph and crypto.news amplified into October 19. Transfers ran from 23:42 UTC October 17 to 01:26 UTC October 18. Computors stopped the chain at tick 85,371,949, where public RPC checks still sat when desks wrote overnight. For a rug room, this is not a smart-contract reentrancy story — it is a seed-entropy failure that turns “I never shared my phrase” into an empty balance.
Qubic says the issue was in wallet seed generation, not in consensus or the protocol’s transaction rules. Affected creation paths, per the core team: any browser on an iPhone or iPad before October 18, 2026; Safari on a Mac before that date; and the Qubic iOS app before July 2025. Scope is where and when the seed was born, not which device opens the vault today. Importing a weak seed into a desktop client or hardware shell does not repair it. Web wallet 4.26.4 (dated October 18 in release notes) replaces JavaScript’s Math.random() with crypto.getRandomValues() for new seeds — a correct fix for the generator that cannot retroactively add entropy to an already-minted secret.
Containment math, still Qubic’s account: 87.1% of drained QU never left the network and sits immobilized under the halt (about 2.56 trillion QU on that cut); the other 12.9% (~379 billion QU) reached MEXC, which froze the receiving account within about an hour after contact. MEXC also suspended QUBIC deposits and withdrawals at the project’s request; XT posted a parallel pause covering QUBIC and KASPLEX rails on October 18. No desk has a confirmed return of stolen tokens to original owners. Market cap context around the report sat near $62.6 million on CoinGecko — small enough that a halt freezes the whole tape, not just the attacker’s hop wallets.
Recovery is a governance problem now. Qubic’s core team is tagging compromised addresses and drafting options for a Computor vote — the operators who run Useful Proof of Work consensus and will decide what happens to frozen inventory. The project has not said whether that means reversing unauthorized transfers, another clawback path, or separate compensation. Restart timing is unannounced. A full technical report is promised only after a recovery plan settles. Users were told the team will never DM for a seed or sell “paid recovery,” and that police or cybercrime filings with wallet ID, amount, and explorer links help exchanges keep freezes in place.
The pattern should look familiar to anyone who followed Coldcard’s July 2026 weak-RNG firmware chapter (~594 BTC / ~$38 million across ~500 wallets in a short window), Trust Wallet’s 2023 browser-extension episode, or Libbitcoin Explorer’s Milk Sad seed flaw. Patch the generator; migrate survivors to brand-new seeds; never treat an app update as a free key rotation. For NFT and gaming desks holding QU or bridging into Qubic-adjacent rails, the practical rule is blunt: if your seed was created on an affected Apple/Safari/iOS path, assume the secret is burned — even if your address was not among the first 1,404 emptied — and wait for official migration instructions before you try to move anything on a still-halted tick.
This chapter is separate from overnight’s Cysic bridge mint file: different chain, different failure mode (seed entropy vs fraudulent mint message), same recovery-room checklist — freeze what you can, name what left, fix the generator, and do not reopen until the vote and migration path are public.
What to watch on-chain next: Confirm whether public RPC remains stuck at tick 85,371,949 or advances only after a Computor-approved recovery plan posts. Watch MEXC/XT for any QUBIC deposit reopen that lands before Qubic’s official migration guide — that would be a red flag for holders still on weak seeds — and track whether the project’s follow-up names returned balances versus unrecovered exchange legs.
Bottom line: Qubic froze the chain at tick 85,371,949 after weak wallet seeds let an attacker empty 1,404 wallets of ~2.94 trillion QU (~$1.4 million). Most stolen QU is halted on-network; MEXC froze the exit leg; restart and recovery still need a Computor vote.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
