Qubic Hack Leaves $1.4 Million in Stolen Tokens Frozen
Qubic halted transaction processing after an attacker exploited weak randomness in the recovery-seed generation for some wallets. Most of the reported $1.4 million haul remains on the network. The halt may have stopped the tokens from moving, but frozen funds are not recovered funds, and Qubic has yet to announce a recovery plan.
- Qubic reported that about 2.94 trillion QU was stolen from more than 1, 400 accounts.
- It said 87.1% of the tokens remained on its network. MEXC restricted an account that received the rest.
- A wallet update changes how new seeds are generated, but the safety of older phrases remains unclear.
- No recovery plan had been approved, and no restart date had been announced in the available reporting.
A wallet-seed flaw, according to Qubic
In a statement dated Oct. 18, 2026, Qubic blamed the theft on weak randomness in the generation of some wallet recovery seeds. Cointelegraph reported the project’s estimate that the attacker took about 2.94 trillion QU, worth roughly $1.4 million, from more than 1, 400 accounts.
The dollar figure is an estimate based on the reported token amount. It does not show how much the attacker received by selling. Qubic is the source for the figures and the number of affected accounts. The reporting does not include independent forensic confirmation.
A recovery seed, often shown as a phrase, is used to derive or restore the private keys that control a wallet’s funds. If the seed is predictable, an attacker may be able to reconstruct those keys without getting the phrase directly from its owner. Qubic described the vulnerability as a wallet-software issue, not a confirmed compromise of the blockchain protocol.
Qubic said it halted transaction processing at tick 85, 371, 949. The project did not explain what a “tick” measures in its account. The number is best understood as Qubic’s marker for when processing stopped, not as a measure of how long the network was down.
Qubic said 87.1% of the stolen tokens, about 2.56 trillion QU, remained on its network. The other 12.9%, or roughly 379.26 billion QU, reached an account at MEXC. Qubic said the exchange restricted that account within about an hour and later suspended QUBIC deposits and withdrawals at the project’s request. The available reporting does not include independent confirmation from MEXC, whose Guardian Fund reserve has also drawn attention.
“Frozen” does not mean “returned.” Qubic has not confirmed that any stolen tokens have been restored to their original owners.
The update addresses new seeds, not old ones
Cointelegraph reported that Qubic’s web wallet version 4.26.4 replaced JavaScript’s Math.random(), which is not designed for cryptographic secrets, with crypto.getRandomValues(), a function designed to generate cryptographically secure random values.
The change addresses how new seeds are generated. On its own, it does not show that older recovery phrases are safe. Nor does changing a function prove that every part of the seed-generation process has been independently reviewed. Qubic has not confirmed the security of phrases created with affected software.
Qubic’s reported scope includes seeds generated through any browser on an iPhone or iPad before Oct. 18, 2026; through Safari on a Mac before that date; and through the Qubic iOS application before July 2025. These are the methods and dates Qubic identified. They are not an independently verified breakdown of which devices or accounts were compromised.
The available reporting does not include specific instructions from Qubic for users with potentially affected wallets. Installing an update should not be taken as proof that an existing recovery phrase is safe. Users need clear, direct guidance from the project about their situation.
Frozen funds leave a difficult governance decision
Qubic said its core team was identifying affected wallets and preparing recovery proposals for its Computors, participants in the project’s consensus process. The Computors are expected to vote on how to handle the frozen tokens. No proposal had been approved, and Qubic had not announced a date for resuming network operations in the available reporting.
Qubic has not specified the options. Reversing unauthorized transfers, distributing frozen tokens through another mechanism, compensating users separately, or choosing another remedy would raise hard questions about ownership, fairness and who bears the loss.
The halt shows Qubic could stop transaction processing during the incident. But the available account does not explain the rules or safeguards behind that decision, or how affected users will have a voice in the recovery process. Emergency powers can contain damage, but they need transparent limits. Calling a system “decentralized” does not settle who gets to decide what happens next. Related coverage reported that Qubic halted its network after the wallet drain.
Cointelegraph has also linked the incident to earlier reported seed-generation vulnerabilities involving Coldcard, Libbitcoin Explorer and Trust Wallet. The details differ, but the lesson is clear: wallet security can fail before a transaction reaches a blockchain. A network cannot make a predictable recovery secret unpredictable after the fact.
Key questions about the Qubic hack
-
How much was stolen?
Qubic reported that about 2.94 trillion QU, estimated at roughly $1.4 million, was taken from more than 1, 400 accounts. The available reporting does not independently confirm those figures.
-
Where are the tokens now?
Qubic said 87.1% remained on its network when processing stopped. The rest reached an account that MEXC reportedly restricted. No funds have been confirmed as returned to users.
-
What caused the theft?
Qubic blamed weak randomness in the generation of some wallet recovery seeds. The reported vulnerability concerns wallet software, not a confirmed breach of the blockchain protocol.
-
Does the update protect older recovery phrases?
That remains unclear. Qubic says version 4.26.4 changes how new phrases are generated, but it has not confirmed that older phrases created with affected software are safe.
-
When will the network restart, and will users be compensated?
No restart date or recovery plan had been approved in the available reporting. The Computors are expected to consider proposals, but the outcome and any compensation remain unknown.
