On this page
Key takeaways
- Between 23:42 UTC on October 17 and 01:26 UTC on October 18, 2026, an attacker drained 1,404 Qubic wallets of about 2.94 trillion QU, roughly $1.3 to $1.4 million at the time. The network's operators then halted the chain.
- Qubic says the protocol wasn't hacked. Some wallet seeds were made with too little randomness and could be guessed. Coverage of the fix shows the web wallet had used JavaScript's Math.random(), which isn't built for secrets, and it now uses a secure random generator in version 4.26.4.
- The general lesson: a seed phrase is only as strong as the randomness behind it. Create seeds on a hardware wallet or a well-reviewed wallet app, not in a web page, and treat 'recovery services' that contact you as scams.
Qubic, a blockchain that pitches itself as a network for AI computing, stopped its network on October 18, 2026, after an attacker emptied 1,404 user wallets in under two hours. The blockchain itself wasn't broken. The wallets were created with seeds that weren't random enough, so the attacker could guess them. The lesson reaches well beyond Qubic.
What happened
According to Qubic's incident update, an attacker drained 1,404 wallets between 23:42 UTC on October 17 and 01:26 UTC on October 18, taking about 2.94 trillion QU, Qubic's native token. Press reports valued the haul at roughly $1.3 million to $1.4 million at the time.
Qubic's validators, which it calls Computors, then halted the network at tick 85,371,949. A tick is Qubic's version of a block. With no transactions going through, the stolen coins couldn't move either.
- 87.1% stayed on Qubic's own chain, where the halt has locked it in place, the project says.
- 12.9% reached the MEXC exchange, and MEXC locked the account that received it roughly an hour later.
- Once alerted, exchanges paused QUBIC deposits and withdrawals.
The real problem: seeds that weren't random enough
A seed phrase (Qubic uses a 55-character seed) is the master secret behind a wallet. It's only safe because there are so many possible seeds that nobody could ever guess yours. That safety depends on the wallet using a strong source of randomness when it creates the seed.
Qubic said that "some wallet seeds were generated with insufficient randomness," which made them weaker than intended, and that the flaw was in how seeds were generated, "not in the Qubic protocol itself." The project lists three risky groups:
- seeds made in a web browser on an iPhone or iPad (any browser) up to October 18, 2026;
- seeds made in Safari on a Mac up to the same date; and
- seeds the Qubic app for iOS created before July 2025.
Cointelegraph reported that the code change for wallet version 4.26.4 swapped JavaScript's Math.random() for crypto.getRandomValues(). The first is fine for games and animations but was never meant for secrets. The second is the browser's secure random-number generator. Qubic says no new weak seeds can be created after the fix.
What happens next for Qubic users
Qubic says any fix is up to the Computor quorum, the operators who produce Qubic's blocks and also hold the votes on questions like this. Its core team is working out exactly which wallets were hit and drafting choices for the quorum, and a community poll is open on Discord. A full technical report is promised once recovery is settled. As of October 20 we had not seen a restart date announced.
The project has asked victims to report the theft to police or a national cybercrime agency, giving their wallet ID, how much they lost and a link to the theft transaction on Qubic's block explorer. It says formal reports help exchanges keep stolen funds frozen. US victims can report it to the FBI's IC3 (opens in a new tab) (Internet Crime Complaint Center).
Lessons for every self-custody user
You don't need to hold QU for this to matter. Ask one question about every wallet you control: what created this seed?
- Prefer a dedicated device. A hardware wallet creates the seed on a chip built for that one job, away from your browser and phone apps. Our hardware wallet comparisons explain the options.
- Be wary of seeds made in a web page. Browser-based wallet creators depend on the page's code and the browser. If a project's main wallet runs in a website, think about moving larger balances to a seed created somewhere sturdier.
- Use widely reviewed software. Small projects with home-grown wallets get far less outside scrutiny than major wallet apps.
- If a seed might be weak, move to a fresh one. Make a new wallet with a trusted tool, send a small test amount first, then move the rest. Changing the password on the old wallet doesn't help, because the seed itself is the weakness.
- Never type a seed into a website that asks for it. That includes "checkers" that promise to tell you whether your seed was affected.
Our seed phrase guide covers how to create, back up and store a seed safely.
What to watch
- The Computor vote: whether frozen QU is returned to victims, and how.
- The network restart: when the chain resumes on the patched software, and when exchanges reopen QUBIC deposits and withdrawals.
- The technical report: the exact scope of the weak seeds, and whether any other wallets are at risk.
The takeaway
Qubic's chain did what it was designed to do. The weak point was a wallet that made guessable secrets. A seed phrase is only as strong as the randomness behind it, so know where each of yours came from and create important ones on hardware built for the job. This is education, not financial advice, and it reflects what Qubic had disclosed as of October 20, 2026.
Frequently asked questions
Which Qubic wallets were affected?
Per Qubic, the risky seeds are ones an iPhone or iPad browser produced (whichever browser you used) before October 18, 2026, or that Safari on a Mac produced before then, plus seeds the Qubic app for iOS created before July 2025. If you created a Qubic seed in one of those ways, assume it is exposed and follow the project's official guidance.
Will victims get their QU back?
That hasn't been decided. By Qubic's count, 87.1% of the stolen QU is still sitting on the halted chain where it can't move, and the remaining 12.9% is locked in a MEXC account the exchange froze. Any return of funds is up to the network's Computor quorum.
Does this affect my Bitcoin or Ethereum wallet?
Not directly. The weak seeds came from Qubic's own wallet software. The same kind of flaw has hit other wallets in the past, though, so it's worth knowing which tool created each of your seeds.
What does halting a blockchain mean?
The operators who produce Qubic's blocks, called Computors, stopped processing transactions at one point in the chain. That kept the stolen coins from moving, but it also froze everyone else's QU until the network restarts.
Sources
- Security incident update (thread on X, October 18, 2026) (opens in a new tab) — Qubic
- Qubic freezes chain after attacker drains 1.4K wallets with weak seeds (opens in a new tab) — Cointelegraph via TradingView
- Qubic halts mainnet after wallet drain empties 1,404 accounts (opens in a new tab) — Crypto Briefing
- Qubic Pushes Back on Hack Claims: Weak Wallet Seeds Were to Blame (opens in a new tab) — CryptoPotato
- Qubic halts mainnet: 1,404 wallets drained (opens in a new tab) — CryptoTicker
- Qubic wallet exploit: $1.3M drained, most funds frozen (opens in a new tab) — Tangem
- Cryptocurrency: what to do if you were the target of a cryptocurrency scam (opens in a new tab) — FBI Internet Crime Complaint Center (IC3)
Published October 20, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.