- Weak wallet seeds exposed 1,404 wallets, with approximately $1.3 million in QU stolen.
- Qubic says 87.1% remained on its halted network; MEXC froze the receiving account for the rest.
- Updated software fixes new seed generation, but existing vulnerable seeds still require replacement.
The Qubic hack drained 1,404 wallets of roughly 2.94 trillion QU, worth about $1.3 million, prompting an October 18 network halt. The project blamed weak randomness in wallet seed generation and said its core protocol was unaffected. Most stolen tokens remained on the paused blockchain, while the rest reached an exchange account that was subsequently frozen.
Qubic hack exposes weak seeds across specific wallet setups
In its October 18 security update, Qubic said the theft ran from 23:42 UTC on October 17 to 01:26 UTC. The attacker accessed wallets whose seeds lacked sufficient randomness.
Seeds generate the private keys controlling wallet funds. Predictable generation can let an attacker reconstruct those keys without obtaining the secret directly from its owner.
The Qubic hack affected seeds created through any iPhone or iPad browser before October 18, according to the project. Its warning also covered Mac Safari seeds created before that date and Qubic iOS app seeds predating July 2025.
Developers released wallet version 4.26.4 to improve seed generation, according to the community incident notice. However, updating software does not repair an existing weak seed, so affected users need newly generated, secure credentials.
The project said it would publish a full technical investigation after settling its recovery plan. It attributed the vulnerability to wallet software rather than blockchain consensus.
Frozen tokens await Computor decisions on fund recovery
Network operators, known as Computors, halted processing at tick 85,371,949 after the Qubic hack. The pause immobilized 87.1% of stolen QU still on the network, according to the team.
The remaining 12.9% had reached MEXC. Qubic said the exchange froze the receiving account within about an hour, while deposit and withdrawal services were suspended.
These restrictions do not mean affected holders have received their funds back. Recovery proposals require a decision by the Computor quorum under network rules.
The October 18 update gave no restart date following the Qubic hack or approved restitution mechanism. The team also warned that it would never request wallet seeds, initiate private messages or charge users recovery fees.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
