- Trending
- Comments
- Latest
Qubic validators halted the entire blockchain after an attacker drained about $1.3 million in QU tokens from 1,404 wallets, an exploit the project traces to predictable wallet seed generation rather than a flaw in the protocol itself.
According to an October 18 update from the project, the unauthorized withdrawals occurred between 7:42 p.m. and 9:26 p.m. Eastern Time on October 17. Validators subsequently coordinated a network halt to prevent further movement of the affected tokens.
The project reported that approximately 87.1% of the stolen funds remained immobilized within the network, while the remaining 12.9% had been transferred to cryptocurrency exchange MEXC, where the receiving account was frozen.
Although the intervention restricted the attacker’s ability to move the assets, it also temporarily prevented legitimate users from processing transactions.
The emergency response followed the discovery of unauthorized wallet withdrawals affecting more than 1,400 addresses.
Qubic’s validators, known as Computors, coordinated a shutdown at tick 85,371,949, effectively suspending transaction processing across the blockchain. The network explorer subsequently displayed the same tick, confirming that operations had stopped at that point.
The decision was intended to contain the financial damage while the project’s developers assessed the affected wallets and prepared potential recovery measures.
According to Qubic, 87.1% of the drained tokens remained on the blockchain when transaction processing was suspended. Meanwhile, MEXC reportedly froze the account receiving the remaining assets within approximately one hour.
The exchange’s intervention reduced the attacker’s immediate ability to access or transfer the tokens deposited on its platform.
However, the Qubic exploit also created a broader operational challenge, as the network-wide suspension restricted transactions for users who were not directly affected by the theft.
The financial impact was estimated using prevailing market prices rather than confirmed proceeds received by the attacker.
According to calculations published by The Defiant using CoinGecko pricing at 11:03 a.m. Eastern Time on October 18, the stolen tokens were worth approximately $1.26 million. QUBIC’s circulating market capitalization stood at roughly $61.8 million at that time.
These figures represent the market value of the reported stolen tokens and do not establish how much the attacker ultimately realized.
Qubic attributed the security incident to weaknesses in the process used to generate wallet recovery seeds, rather than a vulnerability in the underlying blockchain protocol.
The project identified the problem as “insufficient randomness,” explaining that predictable seed generation had allowed the attacker to gain access to affected wallets.
“The issue was in seed generation, not in the Qubic protocol itself,” Qubic stated in its official incident update.
The distinction is important because wallet recovery seeds are essential security credentials that determine access to cryptocurrency holdings.
If the random values used to create those credentials are insufficiently secure, attackers may be able to reconstruct vulnerable seeds and obtain control over the associated wallets.
The Qubic exploit affected specific wallet-generation environments, with the project warning users whose seeds were created before October 18, 2026, through any browser on an iPhone or iPad.
The warning also covered wallets generated through Safari on Mac computers before the same date, as well as seeds created in the Qubic iOS application before July 2025.
These restrictions indicate that the vulnerability was associated with particular wallet-generation methods and periods, rather than every wallet connected to the network.
Qubic said a comprehensive technical report would be released after recovery efforts were settled.
Following the incident, Qubic confirmed that it had corrected the wallet seed-generation weakness through version 4.26.4 of its official web wallet.
Release notes dated October 18 identified the security update as a fix to “use cryptographically secure seed generation.”
The accompanying code modification replaced JavaScript’s “Math.random()” function with “crypto.getRandomValues()” in the wallet’s seed-generation routines.
The change addresses a fundamental security concern involving how unpredictable values are produced when creating cryptocurrency wallet credentials.
According to Mozilla’s MDN JavaScript documentation, “Math.random()” is not cryptographically secure and should not be used for security-sensitive applications.
By contrast, “crypto.getRandomValues()” provides cryptographically strong random values suitable for security-related operations.
The Qubic exploit therefore highlights the consequences of using inadequate randomness in wallet software, even when the underlying blockchain protocol itself has not been compromised.
However, correcting the software vulnerability does not automatically recover assets already transferred from affected addresses.
It also does not establish that wallet seeds created under the previous insecure process are safe to continue using.
As investigations continue, users whose wallets fall within the identified exposure periods face the task of assessing their credentials and following official security guidance.
Qubic has outlined several steps for affected users as the project continues investigating the incident and evaluating possible recovery measures.
The team advised victims to file formal complaints with police or relevant cybercrime authorities, providing their wallet IDs, the amounts stolen and corresponding transaction links from the blockchain explorer.
According to the project, official reports could help cryptocurrency exchanges maintain restrictions on accounts associated with the stolen funds.
The Qubic exploit has also prompted warnings about potential recovery scams targeting affected users.
Qubic emphasized that its representatives would not initiate private conversations requesting recovery seeds or demand payments in exchange for recovering stolen cryptocurrency.
Meanwhile, decisions concerning the network’s next steps remain subject to approval by the Computor quorum.
The project’s core team has been identifying affected addresses and preparing possible resolutions for validators to consider. A community poll has also been opened on Discord to gather feedback on the proposed response.
Despite the significant proportion of stolen tokens currently immobilized, Qubic has not established a definitive recovery outcome or confirmed when normal transaction processing will resume.
The Qubic exploit underscores the security risks associated with weak wallet-creation practices and the difficult trade-offs blockchain networks face when responding to large-scale theft.
For affected holders, the immediate focus remains on preserving transaction evidence, following verified communications from the project and awaiting decisions from the network’s validators.
Copyright © 2025 - The Bit Gazette.
