AI-focused mining protocol Qubic (QUBIC) suffered a major security breach that resulted in 1,404 wallets being drained of 2.94 trillion QU tokens worth approximately $1.29 million, causing the asset's price to fall 5.2% to $0.0000004394.
The sharp drop occurred as altcoins pulled back across the broader market, with total cryptocurrency market capitalization declining 2.8% over the same 24-hour window.
Weak Seed Generation Triggers $1.29 Million Drain
According to project disclosures published on October 18, the incident began at 23:42 UTC on October 17 and concluded at 01:26 UTC on October 18, spanning under two hours. Qubic traced the vulnerability to wallet seeds generated with insufficient entropy across specific client software environments.
Affected keys included seeds created in any browser on an iPhone or iPad prior to October 18, 2026, seeds generated using Safari on a Mac before that date, and seeds produced via the official Qubic iOS app prior to July 2025. The core team emphasized that "the issue was in seed generation, not in the Qubic protocol itself," releasing version 4.26.4 to prevent new weak seeds from being generated.
Computors Halt Network as MEXC Freezes Account
To stop additional transfers, Qubic's Computors coordinated an emergency network halt at tick 85,371,949. The transaction pause trapped 87.1% of the stolen tokens on-chain, while centralized cryptocurrency exchange MEXC received the remaining 12.9% of the drained assets and froze the receiving account within about an hour. Exchanges have since suspended all QUBIC deposits and withdrawals while Qubic's core team maps affected user identities and prepares governance proposals for the quorum.
Cysic Bridge Vulnerability Adds to October Exploits
In a separate security incident on October 17, cross-chain protocol Cysic suffered an exploit on BNB Smart Chain, where an attacker breached a service database and exploited flawed processing logic to mint 10 million unauthorized CYS tokens. The Cysic Foundation blacklisted the recipient address within about 76 minutes, restricting 2.8 million CYS remaining in the wallet. Cysic noted that no existing user assets were stolen and the bridge remains closed.
According to tracking data from DefiLlama, October has seen 11 exploits accounting for roughly $6.2 million in disclosed losses, led by a $3.8 million bridge logic flaw at NEAR Intents on October 1.
Why It Matters
The Qubic exploit illustrates how fundamental cryptographic flaws in client-side seed generation can bypass underlying protocol security entirely, putting users at risk despite blockchain-level integrity. While rapid validator coordination and exchange intervention contained the vast majority of the stolen assets, relying on network halts and account freezes highlights the ongoing tension between emergency intervention and decentralized network resilience.
Key Takeaways
- 1,404 wallets were drained of 2.94 trillion QU ($1.29 million) due to client seed entropy flaws.
- Qubic Computors halted the blockchain at tick 85,371,949, keeping 87.1% of stolen funds locked on-chain.
- Centralized exchange MEXC froze the remaining 12.9% of transferred tokens within about 60 minutes.
- A separate database exploit on Cysic resulted in 10 million unauthorized CYS minted on BNB Smart Chain.
