Singapore; October 2026: Qubic, an innovative Layer-1 cryptocurrency and computing platform has suspended its network after an attacker drained around 2.94 trillion QU, roughly $1.3 million, from 1,404 wallets by exploiting weak seed randomness. About 87% of the funds are frozen on-chain and validators will vote on any recovery or refunds.
Qubic - a small-cap token, has been successful is containing the direct market fallout, although the loss is considerably higher in terms of US dollars, and the selling has so far stayed confined to the token itself rather than spreading to the wider crypto market. The bigger near-term pressure is liquidity, with the network halted and exchanges suspending deposits and withdrawals, leaving holders unable to move tokens until the chain restarts. How the Computor vote handles restitution is likely to matter more for the token’s recovery than the theft itself, since a clean, transparent outcome could steady confidence while a drawn-out freeze would add to doubts. The episode may also renew scrutiny of other wallet providers key-generation practices.
According to an official statement by the company: “an attacker exploited weak randomness in wallet seed generation to drain 1,404 wallets of around 2.94 trillion QU tokens, worth roughly $1.3 million, over a window of less than two hours late on October 17 and early October 18 UTC”.
Qubic stressed that the flaw sat in the tool used to create wallet seeds rather than in the blockchain protocol itself. The affected code relied on a random number function that is not designed for cryptographic secrets, which meant seeds that looked long and secure were in practice predictable enough for an attacker to reconstruct a smaller pool of likely candidates and scan them for funded wallets. Wallets created through browsers on iPhone and iPad, through Safari on Mac until October 18, and through older versions of the Qubic iOS app were exposed. The project says the issue is fixed in version 4.26.4.
Validators stopped the network at tick 85,371,949. Around 87% of the stolen tokens remain on Qubic and are frozen by the halt, while the remaining 13% or so was sent to the MEXC exchange, which froze the receiving account. Other exchanges have suspended QUBIC deposits and withdrawals. The token fell more than 10% after the attack, and the project carries a market value of only around $60 million, which keeps the incident small in dollar terms.
The cyber-attack episode offers two lessons for crypto users:
First, is that a secure blockchain does not guarantee secure funds: control rests on private keys, and keys are only as strong as the software that generates them. Similar weak-randomness flaws have hit other wallet tools in recent years.
Second, is that a network able to pause itself and freeze balances is making a trade-off. The halt protected most of the stolen funds, but it also shows that a relatively small group of validators, known on Qubic as Computors, can stop transactions and decide what happens to user assets.
That group now holds the key decision. Readers should watch when and how the network restarts, whether the Computor vote delivers restitution for victims, whether MEXC returns the frozen portion, and what the promised technical report reveals. A clean recovery would support confidence in Qubic’s governance, while a prolonged halt or a contested vote would raise harder questions about how decentralised the network really is.
KEY TERMS USED -
Wallet seed: A string of characters, often shown as a list of words, that generates and restores a crypto wallet’s private keys. Anyone who has the seed controls the funds, so it must be impossible to guess.
Randomness in seed generation: Seeds need to come from a truly unpredictable source. Some ordinary programming functions only look random and follow patterns, which can let an attacker narrow down the possible seeds and find funded wallets. That’s what happened at Qubic.
Layer 1 blockchain: A base blockchain network with its own rules and token, such as Bitcoin or Ethereum, as opposed to an app or network built on top of another chain.
Computors: Qubic’s equivalent of validators: a fixed group of operators who process transactions and vote on network decisions, including whether to halt the chain and what happens to frozen funds.
Tick: Qubic’s unit of network time, similar to a block number on other chains. Halting at a specific tick marks the exact point after which no transactions were processed.
Qubic has reiterated that the weak randomness in wallet seed generation as the problem itself, not the Qubic protocol itself? The issue was not with the core blockchain technology but with how certain software created the initial secret codes for users' wallets, making them predictable to an attacker.
Furthermore, clarifying that a small validator group holds over users’ funds by halting the network? It means that a limited number of network operators, called Computors in Qubic's case, have the power to stop all transactions and potentially influence what happens to frozen assets, which raises questions about decentralisation.
Team Maverick.
