Qubic Freezes Chain After Attacker Drains $1.4M From 1,404 Wallets Via Weak Seeds

Layer-1 blockchain network Qubic halted operations on October 18, 2026, after an attacker drained approximately 2.94 trillion QU, worth roughly $1.4 million, from 1,404 wallets.

The exploit ran for about 104 minutes. Validators, known as Computors, stopped the chain at tick 85,371,949.

The root cause was not a protocol bug. It was a weak random number generator in the wallet’s seed creation layer.

Ad

Ad

How the Attacker Predicted Wallet Seeds

The attacker exploited JavaScript’s Math.random(), which is not designed for cryptographic secrets. Seeds generated with it produce a predictable pattern.

That allowed the attacker to reconstruct wallet seeds without brute force. The affected wallets were those created in any browser on iPhone or iPad, in Safari on Mac before October 18, 2026, or in the Qubic iOS app before July 2025.

This type of flaw is not new. A similar weak-seed entropy attack hit Coldcard users earlier this year, with losses from that firmware TRNG failure exceeding $100 million.

In a near-identical case, the XRP Healthcare wallet key-generation flaw shrank the addressable keyspace and drained $452K from 4,011 users, signaling a recurring industry blind spot.

Meanwhile, Qubic’s team patched seed generation in web wallet version 4.26.4 by switching to crypto.getRandomValues(). The core protocol and QEARN staking remained unaffected.

The attack also fits a broader 2026 pattern. An OpenAI agent recently accessed an Ethereum testnet wallet using publicly exposed recovery phrases pointing to how app-layer key exposure, not consensus bugs, is now the dominant attack surface.

Ad

Ad

87.1% of Funds Frozen On-Chain; MEXC Acts Within the Hour

Of the total drained amount, 87.1% never left the Qubic network. The Computors’ halt locked those funds in place. The remaining 12.9% was moved to MEXC.

However, MEXC froze the receiving account within approximately one hour of the transfer. Both MEXC and Bitget suspended QUBIC deposits and withdrawals.

No restart date has been announced for the network or for exchange services.

This kind of rapid exchange-level response echoes how the GoMining hack, which drained $2.8M across 600+ wallets, was partially contained through consolidated tracing.

Notably, Blockstream’s Liquid Network set a precedent for halting operations in response to a large drain, a model Qubic’s Computors followed here.

The core team is now identifying all affected wallets. Recovery options will go to a Computor vote. A full technical report is planned after a recovery plan is confirmed.

Affected users are advised to file police or cybercrime reports. They should include their wallet ID, the drained amount, and explorer links.

These reports can support further exchange-level freezes. Additionally, Coinbase’s quantum migration guidance underscores the long-term case for verified high-entropy seed generation, a standard this incident shows the industry still struggles to meet consistently.