Qubic wallet drain hits 1,404 users over weak seeds

A Qubic wallet drain emptied 1,404 accounts over the weekend before the network's validators stopped the chain. The attacker took about 2.94 trillion QU, worth roughly $1.3 million, between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18, according to the project's incident figures reported by Bitcoin.com.

What happened

The network halted at tick 85,371,949. Of the stolen tokens, 87.1% never left the chain and are now frozen, while 12.9% was sent to the MEXC exchange, which froze the deposit within about an hour. Bitget suspended QUBIC deposits and withdrawals as a precaution. The whole raid took about an hour and 44 minutes, Crypto Briefing noted, and developers said they secured other exposed funds before the attacker reached them.

The root cause was the way some wallets generated their 55-character seeds. Affected seeds were created with JavaScript's Math.random(), which is not designed for cryptography. According to Qubic, the exposed seeds were created through three routes: a browser on an iPhone or iPad, Mac Safari up to Oct. 18, or the project's iOS app before July 2025. Funds staked in QEARN were not affected.

The fix shipped as wallet version 4.26.4, which switches seed generation to the browser's cryptographically secure crypto.getRandomValues() function.

Weak seeds keep recurring across the industry. In July, Coldcard disclosed thefts after a firmware bug weakened some seeds, and similar flaws hit Trust Wallet's browser extension and the Libbitcoin Explorer tool in 2023, Cointelegraph noted.

Why it matters

Weak randomness is one of the oldest failure modes in crypto, and it bypasses every on-chain safeguard because the attacker simply holds valid keys. We looked at a related debate about how cryptographic constants are chosen in our piece on NIST elliptic curve seeds.

The incident also tests Qubic's governance. The network runs on 676 Computors and needs at least 451 aligned votes to validate an outcome, according to Qubic's consensus documentation cited by Boxmining, and those Computors will vote on recovery options for the frozen funds. That kind of coordinated halt and freeze shows the chain can act fast, but it also highlights how much power a validator quorum holds over user balances.

The market reaction was sharp for a small-cap token. QU fell more than 10% after the news, Bitcoin.com reported, and Cointelegraph put its market value near $62.6 million, citing CoinGecko. The project was founded by Sergey Ivancheglo, known online as Come-from-Beyond.

What's next

Users with older wallets should treat any seed created on the affected platforms as compromised. As Boxmining pointed out, the patch cannot add randomness to a seed that already exists, so updating the app or changing a password is not enough; funds must move to a new identity once transfers resume. Qubic has not said when the network will restart.

Victims have been advised to report the theft to police, Crypto Briefing said, and Qubic plans a full technical report once a recovery plan is settled. The Qubic wallet drain follows an August exploit of the Vottun Bridge, the second incident this year tied to components around the core network.

Exchanges will matter too. If MEXC and the Computors coordinate on returns, most losses from the Qubic wallet drain could be reversed. For wallet makers, the lesson echoes the Ledger CryptoBilis implant case: the weak point sat outside the blockchain itself.