Layer-1 blockchain network Qubic confirmed that a recent security incident between October 17 and 18, which compromised 1,404 wallets and resulted in the theft of 2.94 trillion QU, was triggered by weak wallet seed generation rather than a flaw in the core protocol. Following the exploit, Qubic team members clarified that insufficient randomness during seed creation exposed the affected user funds.
Key Takeaways:
- 1,404 wallets were drained of 2.94 trillion QU during the security incident on October 17 and 18.
- 87.1% of the stolen funds remain frozen on-chain following a network halt executed at tick 85,371,949.
- 12.9% of the stolen assets transferred to MEXC were frozen by the exchange within roughly one hour.
- Seed generation flaws have been patched in software update version 4.26.4.
Network Halt and Seed Vulnerability Details
According to Qubic's official update, the compromised seeds were generated due to insufficient randomness on specific platforms. The vulnerability affected seeds created on iPhones and iPads using any browser prior to October 18, Macs using Safari before October 18, and the Qubic iOS app created prior to July 2025.
To contain the damage, Qubic's validator network, known as Computors, coordinated a pause at tick 85,371,949. This action successfully froze 87.1% of the drained assets directly on the network. The remaining 12.9% was routed to MEXC, where the exchange froze the receiving account within an hour. Centralized exchanges have since suspended QUBIC deposits and withdrawals while resolution plans develop, following initial actions taken when the Qubic network was halted.
Recovery Process and Industry Context
Qubic stated that the seed generation flaw was resolved in version 4.26.4, preventing any new weak seeds from being generated. Final resolution will be decided by the Computor quorum under network governance rules, aided by feedback from an open Discord community poll. The core team advised victims to file reports with local cybercrime authorities, including their wallet ID, total loss amount, and explorer transaction link.
The incident underscores broader security challenges in the industry. Security firm PeckShield tracked 55 major crypto hacks in September totaling $766.5 million in losses—a 462% spike compared to August's $136.3 million. September's totals included a $387 million breach at Bitget and a $320 million exploit involving 4,000 BTC on Liquid Network, which subsequently recovered $285 million.
Why It Matters
This incident highlights that client-side seed generation flaws can be just as destructive as protocol-level smart contract vulnerabilities. However, the quick response by Qubic's Computors to freeze over 87% of the stolen tokens on-chain significantly limited the attacker's ability to cash out. How the validator quorum ultimately redistributes or restores the frozen funds will serve as an important test case for layer-1 emergency governance.
