Qubic halts its blockchain after attacker drains $1.4 million from 1,400 weak-seed wallets

Qubic has halted its blockchain after an attacker drained about $1.4 million (roughly Rs 39 crore at today's dollar rate) from more than 1,400 wallets whose seeds were too weak to keep secret, Cointelegraph reported. The network stopped at tick 85,371,949 on Sunday 18 October and was still paused when Cointelegraph reported on Monday. Qubic has given no restart date.

What went wrong

Qubic's web wallet generated new wallet seeds with JavaScript's Math.random(), a function built for things like shuffling a list, not for creating secrets. Its output can be predicted, so an attacker who understands it can rebuild seeds and empty the wallets made from them.

According to Qubic, the affected seeds are those created:

• in any browser on an iPhone or iPad;
• in Safari on a Mac, up to 18 October 2026;
• in the Qubic iOS app before July 2025.

In all, about 2.94 trillion QU was taken. Qubic's market value was about $62.6 million at the time, on CoinGecko figures cited by Cointelegraph.

Where the money is now

Qubic says 87.1% of the stolen coins are still on its own network, frozen by the halt. The other 12.9% was sent to the MEXC exchange, whose team froze the receiving account within about an hour.

The core team is now identifying affected wallets and preparing recovery options. The network's Computors, the operators who run it, will vote on what happens to the frozen funds, and a full technical report will follow once a recovery plan is agreed. Version 4.26.4 of the web wallet replaces Math.random() with crypto.getRandomValues(), a secure random source.

It is the latest in a run of weak-seed failures, after Coldcard's disclosure in July and earlier flaws in Trust Wallet's browser extension and Libbitcoin Explorer in 2023.

If you hold QUBIC or any crypto wallet

• Made your Qubic seed on an iPhone, iPad or in Safari? Treat it as exposed. When the network restarts, move funds to a new wallet created with the fixed wallet (4.26.4 or later), and follow Qubic's official recovery notice on its own channels.
• Ignore anyone offering to "recover" your coins. Scammers follow every hack. Nobody legitimate needs your seed phrase.
• Never type a seed into a website, chat or form. A real wallet only asks for it to restore, on your own device.
• For larger amounts, use a hardware wallet bought from the maker or an authorised seller, and keep the seed on paper, offline.
• Keep records. If you sell crypto at a profit, see what the tax may be with our capital gains tax calculator, and track prices on our bitcoin page.