- Qubic reported that an attacker drained about 2.94 trillion QU from 1,404 wallets on October 17-18, 2026.
- The team attributed the incident to insufficient randomness in some seed phrases, rather than a vulnerability in the Qubic protocol.
- Qubic said computors halted the network, freezing 87.1% of the stolen funds, while MEXC froze an account that received the remaining 12.9%.
The Qubic layer-1 blockchain reported that an attacker drained about 2.94 trillion QU from 1,404 wallets between 23:42 UTC on October 17 and 01:26 UTC on October 18, 2026. Computors halted the network, leaving transactions unprocessed and preventing the stolen assets from being transferred or sold while the incident is addressed.
According to Qubic’s October 18 statement, the attacker exploited insufficient randomness in the generation of some seed phrases, allowing access to the associated wallets. The team said the problem involved seed phrase generation and was not a vulnerability in the protocol itself.
Network halted and funds frozen
Computors coordinated a network halt at tick 85,371,949, Qubic said. A quorum of computors must make the final decision on the next steps under the network’s rules.
Qubic said 87.1% of the stolen funds remained on the network and were frozen. The attacker transferred the other 12.9% to the MEXC cryptocurrency exchange, where the recipient’s account was frozen within about an hour, according to the team. Qubic said other exchanges were notified and suspended QUBIC deposits and withdrawals.
Seed phrases potentially at risk
According to Qubic, the risk applies to seed phrases created before October 18, 2026, on an iPhone or iPad using any browser, or on a Mac using Safari. Seed phrases created in the Qubic iOS application before July 2025 may also be at risk.
Qubic said it corrected seed phrase generation in version 4.26.4 and that new weak seed phrases can no longer be created. The core team is identifying all affected addresses and preparing options for computors to review. It also opened a poll on Discord so computors can consider the community’s position.
Guidance for affected users
The team advised users who lost funds to contact police or cybercrime authorities in their country. Reports should include the wallet identifier, the amount lost and a link to the transaction in the Qubic explorer.
Qubic also warned of possible scams presented as assistance with recovering funds. The team said its representatives do not contact users first, request seed phrases or offer paid asset-recovery services.
Qubic said it would publish a full technical report after completing the recovery process.
Separately, losses from cryptocurrency hacks reached $766 million in September.
Source: Incrypted
