Qubic's blockchain was paused following a breach that compromised 1,404 wallets and resulted in a loss of about $1.3 million worth of QU tokens.
In a significant security breach, Qubic reported that approximately 2.94 trillion QU were stolen from 1,404 user wallets due to a flaw in the seed phrase generation process. To prevent any further loss, the blockchain was temporarily halted.
Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totaling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next.
— Qubic (@_Qubic_) October 18, 2026
Based on current exchange rates, the stolen amount is valued at about $1.3 million. The hackers exploited vulnerabilities that allowed them access to wallets for around 104 minutes, transferring funds to controlled addresses.
Details of the Breach
The attack occurred because some seed phrases were generated with insufficient randomness, making them easier to crack. The vulnerability impacted seed phrases created:
- On iPhone and iPad browsers before October 18, 2026;
- On Mac using Safari before October 18, 2026;
- In the Qubic mobile app for iOS until July 2025.
Developers have since updated the generation mechanism in version 4.26.4, ensuring that weak seed phrases can no longer be produced.
Recovery Efforts
Following the discovery of the breach, Qubic network operators, known as Computors, agreed to an emergency halt of the blockchain at the tick mark of 85,371,949. With transactions suspended, the majority of stolen tokens, approximately 2.56 trillion QU, remain within the network.
However, about 12.9% of the total theft, or roughly 379 billion QU, was transferred to the MEXC cryptocurrency exchange, which promptly froze the receiving account for about an hour. Qubic has alerted exchanges to pause any transactions involving QUBIC.
A quorum of network operators will decide on the next steps, with a detailed technical report to be issued when the recovery plans are established. A community poll has been initiated in Discord to gather feedback from users.
The timeline for resuming the blockchain is still unclear, with the primary team focused on assessing the affected wallets.
Concerns Over Weak Seed Phrases
Weak seed phrases highlight a vulnerability where attackers need not compromise the blockchain or access physical devices; they can simply reproduce the initial values to recover keys. This issue has previously affected hardware wallet users, leading to significant losses.
In a related incident, hardware wallet Coldcard faced similar challenges, resulting in the theft of over 1,778 BTC worth approximately $112.7 million due to a flaw in their entropy generator.
Previously, in July 2025, Qubic had announced ambitions to take control of 51% of Monero's hash rate, an effort later criticized as a PR stunt.
