Qubic Addresses Massive Wallet Breach Caused by Weak Seed Generation
Network halts transactions after 2.94 trillion QU tokens are drained from compromised wallets.
1Security Incident Overview
Qubic confirmed a major security breach occurring between October 17 and 18, resulting in the theft of 2.94 trillion QU tokens. Attackers successfully drained 1,404 individual wallets during this window. The network team clarified that the vulnerability originated from weak wallet seed generation rather than any fundamental flaw within the Qubic protocol architecture.
2Root Cause Analysis
The compromise stemmed from insufficient randomness during the seed generation process on specific devices. Affected wallets were created on iPhones, iPads, and Macs using Safari before October 18, or via the Qubic iOS app prior to July 2025. Version 4.26.4 has now been released to permanently resolve this specific seed generation vulnerability.
3Immediate Network Response
To mitigate further losses, Qubic validators, known as Computors, executed a network halt at tick 85,371,949. This emergency measure successfully froze 87.1% of the stolen funds on the network. Additionally, the MEXC exchange acted within an hour to freeze the receiving account, while other exchanges suspended all QUBIC deposits and withdrawals immediately.
4Recovery and Governance
The Qubic Core team is currently identifying affected identities and formulating resolution options for the Computor quorum. A community poll is active on Discord to gather user feedback regarding the recovery process. Future actions depend entirely on the quorum's decision, which will be executed according to the established rules of the network.
5User Reporting Procedures
Qubic has officially urged all affected users to file reports with local police or relevant cybercrime authorities. These reports must include the specific wallet ID, the total amount of lost tokens, and the transaction link from the Qubic explorer. This documentation is essential for the ongoing investigation and potential future recovery efforts.
6Broader Industry Context
The Qubic incident follows a volatile September for the crypto sector, characterized by 55 major hacks totaling $766.5 million in losses. This figure represents a 462% increase compared to August's $136.3 million. High-profile breaches, including those at Bitget and the Liquid Network, significantly contributed to the industry's total monthly financial damage.
7Bitget Security Breach
The Bitget exchange suffered a massive $387 million loss after an attacker exploited a backend system to manipulate transaction data. By bypassing authorization checks, the perpetrator gained unauthorized access to funds. Bitget CEO Gracy Chen confirmed the exchange will utilize its $464 million User Protection Fund to cover all losses for affected users.
8Liquid Network Theft
The Liquid Network theft involved the unauthorized withdrawal of approximately 4,000 BTC from a federation wallet. While the attacker initially promised to return funds after patches were applied, skepticism remains regarding their motives. Ledger CTO Charles Guillemet questioned the attacker's legitimacy, highlighting the persistent risks associated with centralized federation wallet management systems.