Qubic, a layer-1 blockchain platform, has paused its network following a major security breach in which approximately $1.4 million in tokens were stolen from over 1,400 wallets. The exploit resulted in the theft of around 2.94 trillion Qubic (QU) tokens.
Network halted after massive theft
The Qubic blockchain was stopped at tick 85,371,949 on October 18, after the platform detected that funds were being illicitly withdrawn. As of the latest update, the network remains offline with no announced restart date.
The project’s core team identified that the attacker exploited wallets whose recovery seed phrases were created with insufficient randomness. This vulnerability made it easier to compute private keys and access the associated funds. The breach specifically affected wallets generated by certain browsers and the Qubic iOS app prior to key security updates.
Qubic’s team detailed that between 23:42 UTC on October 17 and 01:26 UTC on October 18, an attacker drained 1,404 Qubic wallets, amounting to roughly 2.94 trillion QU tokens.
Majority of stolen tokens remain frozen
Qubic reported that 87.1% of the stolen tokens, representing about 2.56 trillion QU, are still on its network and have been frozen to prevent further transfers. The remaining 12.9%, or roughly 379.26 billion QU, was transferred to the cryptocurrency exchange MEXC. MEXC responded by freezing the implicated account within about an hour of the breach being discovered.
Both MEXC and cryptocurrency exchange XT have since suspended deposits and withdrawals for Qubic’s token. XT also cited wallet upgrades and maintenance as reasons for the temporary halt to services.
So far, Qubic has not confirmed any return of stolen tokens nor announced a specific recovery mechanism for affected users.
| Platform | Tokens Stolen | Status |
|---|---|---|
| Qubic Network | 2.56 trillion QU | Frozen |
| MEXC Exchange | 379.26 billion QU | Account frozen |
Details of the wallet vulnerability
According to the development team, the vulnerability originated from the Qubic wallet software rather than the blockchain. Inadequate random number generation was used in the creation of recovery seeds, particularly when using browsers on iPhones, iPads, or the Qubic iOS app before recent updates. Safari on Mac prior to October 18, 2026, was also affected.
This flaw has been addressed in web wallet version 4.26.4. The update replaces JavaScript’s Math.random() with the more secure crypto.getRandomValues() function, which is designed for cryptographic randomness. The correction applies to new wallets, but those created with earlier versions may still be at risk.
Mini dictionary: crypto.getRandomValues(), a browser API providing cryptographically strong random values, is preferred over Math.random() for use in generating cryptographic keys and recovery seeds because it offers greater security against predictive attacks.
Other high-profile incidents related to weak wallet entropy have previously affected the industry. For example, in July 2026, attackers exploited a firmware bug in Coldcard wallets, stealing 594 Bitcoin, valued at $38 million, from about 500 wallets. Similar security flaws impacted Trust Wallet’s browser extension and the Bitcoin tool Libbitcoin, known in part for the “Milk Sad” bug that enabled the theft of over $900,000 in Bitcoin.
Security analysts noted that the Qubic exploit highlights the ongoing threat posed by poorly implemented randomness in wallet software and the significant risks to asset security.
Ongoing recovery efforts and community response
Qubic is currently working to identify all wallets affected by the recent attack. The platform’s operators, called Computors, are expected to vote on a resolution for the management of frozen funds and next steps in recovery for victims. No formal plan has yet been approved, and the project has not provided guidance about when service may resume.
Qubic operates as a fee-free, layer-1 blockchain supporting both transactions and smart contracts via its proprietary Useful Proof of Work (uPoW) consensus mechanism, which utilizes mining resources to train artificial intelligence models.
At the time of the exploit, Qubic’s token had a market capitalization of approximately $62.6 million, according to CoinGecko’s estimates.
Data from AMLBot’s 2026 report showed that hacks and exploits accounted for 19% of documented crypto crime cases in Q3, yet represented 40% of recorded monetary losses during that period.
