# Qubic Network Halts Following $1.3 Million Wallet Exploit

Predictable wallet seeds on legacy Apple software enabled a massive cryptocurrency theft.

- **Source:** [Bitcoin News](https://brifing.si/source/d8aeaf1e-9839-4dad-9d25-7a6bf3fbeef8)
- **Published:** 2026-10-18
- **Topic:** [Finance](https://brifing.si/c/finance)
- **Original article:** <https://news.bitcoin.com/security/qubic-loses-1-3-million-in-wallet-raid-before-network-halts/>
- **On Brifing:** https://brifing.si/s/b74782af-3957-417e-a026-18d3f91c425c

## Network Halt After Theft

Between October 17 and 18, 2026, the Qubic network experienced a significant security breach. An attacker drained 1,404 wallets, stealing approximately 2.94 trillion QU tokens valued at $1.3 million. In response to the unauthorized transfers, network validators intervened by halting all transactions at tick 85,371,949 to prevent further asset loss.

## Predictable Seed Vulnerability

The exploit did not target blockchain protocol vulnerabilities but rather flawed wallet seed generation. Older Apple devices and specific browser versions produced predictable 55-character seeds with insufficient randomness. This allowed the attacker to reconstruct private keys for active wallets, bypassing traditional security measures without needing to compromise the underlying network architecture directly.

## Impacted Software Environments

Affected wallets were primarily generated on iPhones, iPads, and Mac devices using Safari or outdated versions of the Qubic iOS application. Developers confirmed that this specific vulnerability was addressed in software version 4.26.4. Before the attacker could access additional funds, the development team successfully secured other potentially vulnerable wallets to prevent further theft.

## Stolen Assets Remain Trapped

The heist resulted in an unusual outcome for the perpetrator. Approximately 87.1% of the stolen QU tokens remain immobilized on the Qubic network due to the suspension. Meanwhile, the remaining 12.9% of funds reached the MEXC exchange, where the platform promptly froze the receiving account, effectively trapping the majority of the stolen assets.

## Market and Exchange Reactions

Following the exploit, the native Qubic currency experienced a price decline of over 10% by Sunday morning. Beyond the immediate network freeze, Bitget suspended all QUBIC deposits and withdrawals for maintenance purposes. These measures reflect the broader operational challenges exchanges face when managing assets linked to active, high-profile security incidents on smaller networks.

## Governance and Restitution Uncertainty

The future of the stolen funds currently rests with the Qubic Computor quorum. While QEARN stakes remained unaffected by the breach, victims are awaiting a formal decision regarding potential reimbursement. The network's governance structure must now determine how to handle the immobilized tokens and whether to initiate a recovery process for the affected users.

## Project Background and Controversy

Qubic was founded by Sergey Ivancheglo, a developer previously associated with NXT and IOTA. The project gained notoriety in 2025 after claiming majority control over Monero’s mining hashrate, which triggered significant alarm within the privacy coin community. This history of contentious network interactions contrasts with the current internal security crisis regarding their own wallet software.

## Security Lessons for Developers

This incident underscores the critical importance of entropy in cryptographic key generation. Relying on legacy software environments for sensitive wallet operations poses severe risks, even if the blockchain itself remains secure. Developers must ensure that random number generation remains robust across all supported platforms to prevent similar predictable seed attacks in the future.

## Sources covering this story

- https://news.bitcoin.com/security/qubic-loses-1-3-million-in-wallet-raid-before-network-halts/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._
