Qubic Blockchain Halted Following Theft of 2.94 Trillion QU
Insufficient randomness in seed phrase generation led to the compromise of 1,404 wallets.
1Security Breach Overview
Between October 17 and 18, 2026, the Qubic L1 blockchain suffered a significant security incident. An attacker successfully drained approximately 2.94 trillion QU tokens from 1,404 individual wallets. The breach occurred within a specific timeframe, starting at 23:42 UTC on October 17 and concluding by 01:26 UTC on October 18.
2Root Cause Analysis
The Qubic team identified the vulnerability as insufficient randomness during the generation of certain seed phrases. Crucially, the core protocol itself remains secure and uncompromised. The flaw was isolated to the entropy generation process, which allowed unauthorized parties to derive private keys and gain access to user wallets created within specific environments.
3Network Halt Mechanism
To prevent further unauthorized transfers, the Computors coordinated a complete network shutdown at tick 85,371,949. This emergency measure effectively halted all transaction processing across the blockchain. By freezing the network, the team ensured that stolen assets could not be moved or sold, providing a window to assess the total impact and coordinate recovery.
4Asset Recovery Efforts
Approximately 87.1% of the stolen funds remain within the Qubic network and are currently frozen. The remaining 12.9% were transferred to the MEXC crypto exchange. The exchange acted swiftly, freezing the attacker's account within an hour. Other exchanges were also notified to suspend all QUBIC deposits and withdrawals to prevent further liquidation.
5Affected User Environments
The vulnerability specifically impacted seed phrases generated in certain environments before October 18, 2026. This includes wallets created on iPhones or iPads using any browser, and on Macs via Safari. Additionally, users who generated seed phrases using the Qubic iOS application prior to July 2025 are also at risk of potential compromise.
6Remediation and Updates
Qubic has released version 4.26.4, which officially patches the seed phrase generation flaw. The team confirms that creating new, weak seed phrases is no longer possible with this update. Users are advised to transition to secure generation methods immediately, as the team works to identify all affected addresses for potential future resolution.
7Governance and Recovery
The final decision regarding the restoration of the network and potential compensation rests with the quorum of Computors. The core team is currently preparing various recovery options for consideration. A Discord poll has been initiated to gather community input, ensuring that the path forward aligns with the consensus of the network's stakeholders.
8User Safety Protocols
Affected users are encouraged to report the theft to their local cybercrime authorities using their wallet ID and transaction links. The team explicitly warned against phishing scams, stating they will never initiate contact, request seed phrases, or offer paid recovery services. A full technical report will be published once the recovery process concludes.
Original article: INCRYPTED — Qubic Blockchain Halted Following Theft of 2.94 Trillion QU